# Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.29 - Missing Authorization to Authenticated (Subscriber+) Test Email Sending and User Email Disclosure

- **ID:** WPSEC-2026-1997
- **Plugin:** Kali Forms — Contact Form & Drag-and-Drop Builder (`kali-forms`), https://wordpress.org/plugins/kali-forms/
- **Affected versions:** all versions before 2.4.30
- **Fixed in:** 2.4.30 (Update to 2.4.30 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/kali-forms
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1997/

## Description

The Kali Forms plugin for WordPress is vulnerable to unauthorized access via the 'kaliforms_test_email' AJAX action in all versions up to, and including, 2.4.29, due to a missing capability check in the test_email() function, which only verified a nonce that is exposed on every front-end page displaying a Kali Forms form. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make the site send the plugin's test email to arbitrary recipients with an arbitrary From address, and to supply any user ID so the email goes to that user, with the user's email address returned in the response.

## References

- https://wpsec.com/vuln/WPSEC-2026-1997/
- https://plugins.svn.wordpress.org/kali-forms/tags/2.4.30/
- https://wordpress.org/plugins/kali-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1997/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.