CVE-2026-3584: 
WordPress vulnerability analysis and mitigation

CVE-2026-3584 is a critical unauthenticated Remote Code Execution (RCE) vulnerability in the Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress, developed by WPChill. It affects all versions up to and including 2.4.9, and was disclosed on March 20, 2026. The flaw allows unauthenticated network attackers to execute arbitrary PHP code on the server via the plugin's form_process function. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, ENISA EUVD).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The root cause lies in the prepare_post_data function, which maps user-supplied HTTP request keys directly into internal placeholder storage without sanitization or validation. These attacker-controlled placeholder values are then passed to PHP's call_user_func() within the form_process function, allowing an unauthenticated attacker to invoke arbitrary PHP functions with attacker-supplied arguments. No authentication, special privileges, or user interaction is required for exploitation. A public PoC exploit (mass_scanner.py) and Nuclei detection templates are available (Wordfence, GitHub PoC, Plugin Source).

Successful exploitation grants unauthenticated attackers full remote code execution on the WordPress server, resulting in complete compromise of confidentiality, integrity, and availability. Attackers can read sensitive data (database credentials, user PII), modify or deface website content, install backdoors or malware, and escalate privileges (e.g., via wp_set_auth_cookie to create rogue admin sessions). Lateral movement to other systems on the same network is also possible from a compromised server (Wordfence, ENISA EUVD).

A public proof-of-concept exploit (mass_scanner.py) was published on GitHub and implements a four-phase exploitation pipeline: API reconnaissance, form discovery, RCE testing (e.g., invoking phpinfo), and privilege escalation via wp_set_auth_cookie (GitHub PoC). Wordfence confirmed active in-the-wild exploitation as of April 2026 (Wordfence). Nuclei detection templates have also been added to ProjectDiscovery's template library. The EPSS score is approximately 0.287%, and no CISA KEV listing has been identified in the available data. No specific threat actor attribution has been published.

1. Reconnaissance: Use tools like Shodan, Censys, or the PoC's built-in API scanner to identify WordPress sites running the Kali Forms plugin (versions ≤ 2.4.9) by querying for plugin-specific endpoints or REST API responses.
2. Form Discovery: Query the WordPress REST API (e.g., /wp-json/kali-forms/v1/) to enumerate active Kali Forms form IDs on the target site.
3. Craft Malicious Request: Submit an HTTP POST request to the form processing endpoint (triggering form_process), injecting attacker-controlled keys into the request body that map to PHP function names (e.g., thisPermalink=phpinfo) via the prepare_post_data function's placeholder mechanism.
4. Achieve RCE: The server calls call_user_func() on the attacker-supplied function name, executing arbitrary PHP (e.g., phpinfo(), system('id'), or a reverse shell payload).
5. Privilege Escalation: Supply entryCounter=wp_set_auth_cookie with a target admin user ID as the argument to forge a WordPress authentication cookie, gaining administrative access to the WordPress dashboard.
6. Post-Exploitation: Use admin access or shell access to install a web shell, exfiltrate data, or pivot to other systems on the network (GitHub PoC, Wordfence).

• Network: Unusual POST requests to Kali Forms processing endpoints (e.g., /wp-admin/admin-ajax.php or REST API routes for kali-forms) containing PHP function names (e.g., phpinfo, system, wp_set_auth_cookie) in form field keys or values; outbound connections from the web server to unknown external IPs.
• Logs: WordPress access logs showing repeated POST requests to form endpoints with anomalous parameter names; PHP error logs referencing unexpected call_user_func invocations or function execution errors; authentication logs showing new admin sessions created without corresponding login events.
• File System: Newly created PHP web shell files in the WordPress uploads directory or plugin directories; modified plugin files (especially class-form-processor.php); unexpected cron jobs or scripts added to the server.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) executing system commands; unexpected outbound network connections initiated by PHP-FPM or Apache/Nginx worker processes (Wordfence, GitHub PoC).

Update the Kali Forms plugin to a version beyond 2.4.9 immediately, as the patch was released in changeset 3487024 (Plugin Changeset). If an immediate upgrade is not possible, temporarily deactivate the Kali Forms plugin to eliminate the attack surface. Additionally, deploy Web Application Firewall (WAF) rules to detect and block malicious form_process requests containing PHP function names in form parameters. Monitor server and WordPress logs for signs of exploitation as described in the IOCs section (Wordfence).

Wordfence published a dedicated blog post in April 2026 confirming active exploitation of this vulnerability in the wild and urging immediate patching (Wordfence). The vulnerability was highlighted in Wordfence's weekly WordPress vulnerability report for March 16–22, 2026 (Wordfence Weekly). Security community members discussed the issue on Mastodon and Bluesky, and it was featured in multiple weekly vulnerability roundups and threat landscape digests. SecurityOnline.info published a dedicated write-up on the vulnerability (SecurityOnline). ProjectDiscovery added Nuclei detection templates for automated scanning.