LiveActive security incident?Get immediate response
CVE Record

CVE-2020-36712: Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion

The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kaliforms_form_delete_uploaded_file function lacking any privilege or user protections. This makes it possible for unauthenticated attackers to delete any site post or page with the id parameter.

HighCVSS 8.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2020-36712 affects the Kali Forms WordPress plugin through version 2.1.1. An unauthenticated attacker could delete site posts or pages by abusing a file-deletion function that lacks privilege checks. The main business impact is availability and content integrity disruption, not data theft.

Executive priority

Prioritize remediation for internet-facing WordPress sites that use Kali Forms. This is high severity because attackers need no account and could remove business-critical pages, causing downtime, reputational impact, or recovery work.

Technical view

The issue is CWE-862 missing authorization in kaliforms_form_delete_uploaded_file. Sources describe unauthenticated arbitrary post deletion using an id parameter. CVSS 3.1 is 8.6 high: network exploitable, low complexity, no privileges or user interaction, with high availability impact.

Likely exposure

Exposure is limited to WordPress sites running Kali Forms versions up to and including 2.1.1. Sites not using the plugin, or running unaffected newer versions, are not shown as affected by the supplied sources.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. However, the issue is remotely reachable and unauthenticated, so exposed vulnerable WordPress sites should be treated as realistic targets.

Researcher notes

Evidence supports missing authorization in a named plugin function and arbitrary post or page deletion. The bundle does not provide exploit telemetry, detailed patch notes, or proof of exploitation, so avoid claims beyond unauthenticated remote deletion risk.

Mitigation direction

  • Inventory WordPress sites for Kali Forms installations and versions.
  • Upgrade Kali Forms beyond version 2.1.1 using vendor guidance.
  • Disable or remove the plugin where upgrading is not immediately possible.
  • Back up site content before remediation where operationally feasible.
  • Review recently deleted posts and pages for unexpected changes.

Validation and detection

  • Confirm installed Kali Forms version on each WordPress site.
  • Check whether any instance is version 2.1.1 or older.
  • Review WordPress content audit logs for unauthorized deletions.
  • Verify backups can restore deleted posts and pages.
  • Confirm remediation by rechecking plugin version after update.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-862: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-36712 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.6 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.6CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H3.94Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.6High
CVSS 3.1 vector shape for CVE-2020-36712Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
wpchillKali Forms — Contact Form & Drag-and-Drop Builder0unaffected
Weakness

CWE details

CWE-862

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.