CVE-2026-107343 Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing
MediumCVSS 4.3
EPSS 0.15%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress kali-forms(WordPress) | < 2.4.30 | 2.4.30 |
References
- wpscan.com exploit technical-description vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org