CyberRota Analysis
AI-GeneratedThe Kali Forms plugin for WordPress prior to version 2.4.17 is vulnerable due to insufficient verification of file uploads against existing forms, allowing unauthenticated users to upload files to the WordPress Media Library. While the uploads are restricted to default-allowed MIME types, this could lead to unauthorized content being stored on the site. WordPress site administrators using this plugin should prioritize updating to mitigate potential risks associated with unauthorized file uploads.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload files to the WordPress Media Library; the uploads are limited to WordPress's default-allowed MIME types, so this does not lead to code execution.