Live › vulnerability › CVE-2026-107343
The Kali Forms WordPress plugin before 2.4.30 lacks a capability check on its test-email handler. A logged-in low-privileged user, such as a Subscriber, can make the site send email to any recipient with a spoofed sender address.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 06:48 UTC. All times on this page are UTC.
Sites running the Kali Forms plugin before 2.4.30. The flaw needs a logged-in account with the lowest role, such as Subscriber, so sites with open registration or many user accounts are most exposed. Sites without this plugin or with no logged-in users are not affected.
No product ranges from the sources yet.
2.4.30 are affected.2.4.30 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.
This page as .md · .json · in your agent: get_signal("CVE-2026-107343")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.