CVE-2024-1217: falha de alta gravidade em wpchill Kali Forms — Contact Form &…
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.6epss 0.3%
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the await_plugin_deactivation function in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with subscriber access or higher, to deactivate any active plugins.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Produtos afetados
wpchill · Kali Forms — Contact Form & Drag-and-Drop BuilderCVEs relacionadas — wpchill Kali Forms — Contact Form &…
No mesmo produto, das mais perigosas para as menos.
CVE-2026-3584CRITICALKali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_processEPSS 7.4%CVE-2026-16144HIGHKali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field ParameterEPSS 1.2%CVE-2020-36720HIGHKali Forms <= 2.1.1 - Missing Authorization to Settings UpdateEPSS 0.8%CVE-2020-36712HIGHKali Forms <= 2.1.1 - Unauthenticated Arbitrary Post DeletionEPSS 0.7%CVE-2020-36717HIGHKali Forms <= 2.1.1 - Cross-Site Request ForgeryEPSS 0.5%CVE-2026-15395HIGHKali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field ValueEPSS 0.4%