Live › vulnerability › CVE-2026-107342
The Kali Forms contact form plugin for WordPress has a missing capability check in its test-email handler. A logged-in Subscriber can use it to reveal the email address of any registered user, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 06:48 UTC. All times on this page are UTC.
Sites running the Kali Forms plugin older than 2.4.30 where users can log in, including subscriber-level accounts. Sites without the plugin, or with it at 2.4.30 or later, are not affected. Sites that allow no user registration or login are less exposed.
No product ranges from the sources yet.
kali-forms/kali-forms.php or the plugin header.2.4.30.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-107342")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.