CVE-2026-107343

MediumCVSS 4.3

Published: 01/11/2026(UTC)Updated: 02/11/2026(UTC)Translated: 01/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.

Risk Assessment

A low-privileged user can abuse the site to send emails with a spoofed sender, which may be used for phishing and harm the domain's reputation. It may also lead to email deliverability abuse for the organization.

Recommendation

Update the Kali Forms plugin to version 2.4.30 or later. Consider restricting access to the test-email feature to administrators only.

Other vulnerabilities in Kali Forms WordPress plugin

CVE-2026-107342Medium
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.

Original NVD description (English source)

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS