CVE-2026-107342

MediumCVSS 4.3

Published: 01/11/2026(UTC)Updated: 02/11/2026(UTC)Translated: 01/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.

Risk Assessment

A minimally privileged user can obtain the email addresses of all registered users, including administrators. This facilitates phishing, social engineering, and account takeover attempts.

Recommendation

Update the Kali Forms plugin to version 2.4.30 or later. After updating, verify that the test-email feature does not expose user data.

Other vulnerabilities in Kali Forms WordPress plugin

CVE-2026-107343Medium
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.

Original NVD description (English source)

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS