CVE-2026-107343
Received Received - Intake

Kali Forms Plugin Unauthenticated Email Spoofing Vulnerability

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: WPScan

Description
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-107343
EUVD
EUVD-2026-114776

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Kali Forms — Contact Form & Drag-and-Drop Builder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Kali Forms WordPress plugin before version 2.4.30. It allows low-privileged users like Subscribers to send emails to arbitrary recipients with a spoofed sender address. The plugin fails to perform a proper capability check on its email-sending function, relying only on a nonce accessible to any logged-in user.

Detection Guidance

Check the installed version of the Kali Forms plugin in WordPress. If it is below 2.4.30, the system is vulnerable. Log in as a low-privileged user like Subscriber and attempt to access the test-email handler endpoint to verify if unauthorized email sending is possible.

Impact Analysis

An attacker could exploit this to send phishing emails or spam from your site, potentially damaging your reputation. It may also allow unauthorized communication to external parties using your domain, posing risks for trust and security.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or misuse, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update the Kali Forms plugin to version 2.4.30 or later immediately. If updating is not possible, consider disabling the plugin until a patch is applied. Review user roles and permissions to ensure no unnecessary low-privileged users have access to sensitive functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107343. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart