CyberRota Analysis
AI-GeneratedThe Kali Forms plugin for WordPress prior to version 2.4.17 is vulnerable due to inadequate capability checks during post duplication, allowing users with Contributor-level access or higher to duplicate any post and access private metadata, including sensitive information. This could lead to unauthorized exposure of confidential data stored within the plugin. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential data leaks and maintain security.
Original NVD Description
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17.