CVE-2026-3584 Kali Forms Remote Code Execution

CVE-2026-3584 is a critical-severity vulnerability. AttackerView checks WordPress sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-3584?

Detects the Kali Forms WordPress plugin before version 2.4.10, where the form processor maps user-supplied POST keys into internal placeholder storage. Placeholders like {entryCounter} and {thisPermalink} are later passed to call_user_func(), allowing unauthenticated attackers to execute arbitrary PHP functions.