CVE-2024-22305
📋 TL;DR
This CVE describes an Insecure Direct Object Reference (IDOR) vulnerability in the Kali Forms WordPress plugin. Attackers can bypass authorization by manipulating user-controlled keys to access or modify form data they shouldn't have permission to view. All WordPress sites using Kali Forms versions up to 2.3.36 are affected.
💻 Affected Systems
- Kali Forms WordPress Plugin
📦 What is this software?
Kali Forms by Kaliforms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive form submissions containing PII, payment information, or confidential data, potentially leading to data breaches, compliance violations, and reputational damage.
Likely Case
Unauthorized access to form submission data, potentially exposing user information, contact details, or other submitted content.
If Mitigated
With proper access controls and authentication checks, impact is limited to authorized users only accessing their own data.
🎯 Exploit Status
IDOR vulnerabilities typically require some level of access but are easy to exploit once initial access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.38
Vendor Advisory: https://patchstack.com/database/vulnerability/kali-forms/wordpress-kali-forms-plugin-2-3-38-insecure-direct-object-references-idor-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Kali Forms
4. Click 'Update Now' if available
5. If manual update needed, download version 2.3.38+ from WordPress.org
6. Deactivate old plugin, upload new version, activate
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable Kali Forms plugin until patched
wp plugin deactivate kali-forms
Restrict Access
allImplement IP whitelisting for WordPress admin area
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect IDOR patterns
- Enable detailed logging and monitoring for unauthorized access attempts to form data endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Kali Forms → Version numberCheck Version:
wp plugin list --name=kali-forms --field=versionVerify Fix Applied:
Verify Kali Forms version is 2.3.38 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to form submission endpoints
- Multiple failed authorization attempts followed by successful access
Network Indicators:
- HTTP requests to Kali Forms endpoints with manipulated IDs or parameters
SIEM Query:
source="wordpress.log" AND (uri="/wp-admin/admin-ajax.php" OR uri LIKE "%/kali-forms/%") AND (parameters CONTAINS "action=get" OR parameters CONTAINS "submission")🔗 References
- https://patchstack.com/database/vulnerability/kali-forms/wordpress-kali-forms-plugin-2-3-38-insecure-direct-object-references-idor-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/kali-forms/wordpress-kali-forms-plugin-2-3-38-insecure-direct-object-references-idor-vulnerability?_s_id=cve
