CVE-2026-16144

The CVSS 8.1 score for this Kali Forms vulnerability conceals a critical precondition: exploitation requires a form field explicitly named 'thisPermalink', 'entryCounter', or 'submission_link'. The function check_if_placeholders_changed() only processes POST keys that exist in the form's field_type_map, so an attacker cannot inject these keys arbitrarily—they need a form that already contains a field with one of these exact names. Without that field present, the call_user_func() vector never triggers regardless of whether the attacker controls other POST parameters. The EPSS score of 0.00688 reflects this gating. But the real question is whether Kali Forms' form builder, default templates, or documentation encourage users to create fields with these names. If the drag-and-drop interface or bundled starter forms suggest using 'thisPermalink' for tracking submissions, the precondition becomes trivially satisfiable and the EPSS underestimates real-world risk. If these names are obscure and user-defined, this is a vulnerability that's theoretically severe but practically difficult to weaponize at scale. The call_user_func() pattern with dynamic field resolution is a known dangerous implementation in WordPress form plugins—similar vulnerabilities have appeared in other form builders going back years. This means even if the specific precondition in Kali Forms is restrictive, the underlying architectural pattern of mapping user-defined field names to callable functions is likely present elsewhere in the ecosystem. What to do: Audit any Kali Forms installations for forms containing fields named 'thisPermalink', 'entryCounter', or 'submission_link'. Treat any such configuration as emergency-priority. If no forms use these names, the vulnerability is still worth patching but the risk is lower. The patch in 2.4.20 should be applied regardless, as the field_type_map gate can erode over time through form imports, template packs, or future plugin updates that create these fields without the user's awareness.

Reviewed through automated stages and approved by a human before publication.