Kali Forms RCE Vulnerability Exploited in Attacks; Patch Available

Summary

The Kali Forms WordPress plugin (versions through 2.4.9) was reportedly exploited for unauthenticated RCE via manipulated form placeholders. Version 2.4.10 patches the flaw; security telemetry recorded over 312,200 blocked attempts.

Key points

The flaw affects Kali Forms versions through 2.4.9; version 2.4.10, released March 20, 2026, contains the patch.
The article attributes the unauthenticated RCE to improper validation in prepare_post_data(), which lets attacker-controlled placeholders reach call_user_func().
A described exploit pattern sets entryCounter to wp_set_auth_cookie, which the article says may enable administrator account takeover if a default administrator account exists.
Security telemetry reportedly recorded exploitation beginning on the disclosure date, with activity peaking April 4–10, 2026.
Security systems reportedly blocked more than 312,200 exploit attempts targeting the plugin.

Article Details

Vulnerability Types: Remote code execution (RCE)
Improper input validation
Severity: Critical
Affected Versions: Kali Forms versions up to and including 2.4.9
Exploitation Status: active
Exploit Availability: public_poc
Patch Status: available

Indicators of compromise

Type	Indicator	Context
IPV4	`1[.]53[.]114[.]181`	Source identified as responsible for over 5,700 blocked Kali Forms exploit requests.
IPV4	`104[.]28[.]160[.]197`	Source identified as responsible for over 9,000 blocked Kali Forms exploit requests.
IPV4	`114[.]10[.]99[.]126`	Source identified as responsible for over 2,500 blocked Kali Forms exploit requests.
IPV4	`124[.]248[.]183[.]139`	Source identified as responsible for over 26,000 blocked Kali Forms exploit requests.
IPV4	`130[.]12[.]182[.]154`	Source identified as responsible for over 11,000 blocked Kali Forms exploit requests.
IPV4	`157[.]15[.]40[.]74`	Source identified as responsible for over 3,000 blocked Kali Forms exploit requests.
IPV4	`202[.]56[.]2[.]126`	Source identified as responsible for over 14,000 blocked Kali Forms exploit requests.
IPV4	`209[.]146[.]60[.]26`	Source identified by threat intelligence as responsible for over 152,000 blocked Kali Forms exploit requests.
IPV4	`49[.]156[.]40[.]126`	Source identified as responsible for over 50,000 blocked Kali Forms exploit requests.
IPV4	`83[.]147[.]12[.]83`	Source identified as responsible for over 1,300 blocked Kali Forms exploit requests.