Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.29 - Missing Authorization to Authenticated (Subscriber+) Test Email Sending and User Email Disclosure
- ID
- WPSEC-2026-1997
- Plugin
- Kali Forms — Contact Form & Drag-and-Drop Builder (kali-forms)
- Affected
- all versions before 2.4.30
- Remediation
- Update to 2.4.30 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Kali Forms — Contact Form & Drag-and-Drop Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Kali Forms plugin for WordPress is vulnerable to unauthorized access via the 'kaliforms_test_email' AJAX action in all versions up to, and including, 2.4.29, due to a missing capability check in the test_email() function, which only verified a nonce that is exposed on every front-end page displaying a Kali Forms form. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make the site send the plugin's test email to arbitrary recipients with an arbitrary From address, and to supply any user ID so the email goes to that user, with the user's email address returned in the response.
References
- https://wpsec.com/vuln/WPSEC-2026-1997/
- https://plugins.svn.wordpress.org/kali-forms/tags/2.4.30/
- https://wordpress.org/plugins/kali-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS