{
 "id": "WPSEC-2026-1997",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1997/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1997/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1997/index.md",
 "title": "Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.29 - Missing Authorization to Authenticated (Subscriber+) Test Email Sending and User Email Disclosure",
 "description": "The Kali Forms plugin for WordPress is vulnerable to unauthorized access via the 'kaliforms_test_email' AJAX action in all versions up to, and including, 2.4.29, due to a missing capability check in the test_email() function, which only verified a nonce that is exposed on every front-end page displaying a Kali Forms form. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make the site send the plugin's test email to arbitrary recipients with an arbitrary From address, and to supply any user ID so the email goes to that user, with the user's email address returned in the response.",
 "plugin": {
  "slug": "kali-forms",
  "name": "Kali Forms — Contact Form & Drag-and-Drop Builder",
  "full_name": "Kali Forms — Contact Form & Drag-and-Drop Builder",
  "wordpress_org": "https://wordpress.org/plugins/kali-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/kali-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/kali-forms"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.30",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.30"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.30",
 "remediation": "Update to 2.4.30 or later.",
 "fix_released": "2026-10-29T06:54:52+00:00",
 "published": "2026-10-30T07:45:53+00:00",
 "updated": "2026-10-29T17:42:40.751928+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1997/",
  "https://plugins.svn.wordpress.org/kali-forms/tags/2.4.30/",
  "https://wordpress.org/plugins/kali-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/kali-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}