CVE-2026-107342 in Kali Forms Plugin
Summary
by MITRE • 11/01/2026
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in Kali Forms — Contact Form & Drag-and-Drop Builder for WordPress prior to version 2.4.30 represents a critical authentication bypass leading to sensitive information disclosure. This flaw stems from an insufficient access control mechanism within the plugin's test-email functionality. Specifically, the handler responsible for processing and returning user email addresses relies exclusively on the validation of a nonces rather than enforcing proper capability checks based on WordPress roles or permissions. In standard WordPress security architecture, actions that modify state or expose sensitive data should require specific capabilities such as manage_options or edit_posts depending on context. By omitting this check, the application fails to verify whether the requesting user has the administrative privilege necessary to access another user's personal information, thereby violating the principle of least privilege and proper authorization enforcement.
From a technical perspective, the core issue lies in the server-side logic that processes requests to the test-email endpoint. While nonces are effective for preventing Cross-Site Request Forgery attacks by ensuring the request originates from an authenticated session with valid intent, they do not inherently validate user roles or permissions. Consequently, any logged-in user possessing a valid nonce can trigger this handler regardless of their assigned role in WordPress. This architectural oversight allows attackers to exploit the endpoint programmatically using tools like curl or Python scripts after authenticating with low-privilege accounts such as Subscribers. The attacker simply needs to obtain a valid nonce for the target action, which is often embedded in admin pages accessible to all logged-in users, and then send a request to the test-email handler specifying the user ID of any registered account.
The operational impact of this vulnerability is significant due to its potential use as an initial vector for further attacks or social engineering campaigns. The primary consequence is the unauthorized disclosure of email addresses belonging to other users, including high-privilege administrators and editors. Email addresses are often used as unique identifiers in many web applications and services. An attacker can leverage these disclosed emails to perform targeted phishing attacks known as spear-phishing, where messages appear legitimate because they reference specific personal details or roles obtained through this enumeration. Furthermore, email addresses serve as critical inputs for credential stuffing attacks if the same credentials are reused across platforms. The ability to enumerate valid administrative accounts also aids in reconnaissance efforts, allowing attackers to tailor subsequent exploits specifically toward privileged users who have access to sensitive site configurations and data stores.
This vulnerability aligns with CWE-284 Improper Access Control, as it reflects a failure to enforce proper authorization policies before granting access to protected resources. Additionally, the exploitation technique maps directly to ATT&CK tactic T1078 Valid Accounts, specifically subtechnique T1078.3 Local Accounts, where an attacker uses valid credentials of low-privilege users to gain initial foothold and then escalates privileges or gathers intelligence through information disclosure. The lack of capability checks is a common pattern in legacy WordPress plugins that prioritize convenience over security, often assuming that the presence of a nonce provides sufficient protection against unauthorized access.
To mitigate this vulnerability, immediate action must be taken by updating the Kali Forms plugin to version 2.4.30 or later, where the developers have implemented proper capability checks within the test-email handler. Administrators should verify their WordPress installation for any remaining instances of older versions and ensure that all plugins are kept up-to-date with security patches released by vendors. In environments where immediate patching is not feasible due to compatibility concerns, temporary mitigations include restricting access to administrative pages via IP whitelisting or implementing a Web Application Firewall rule set designed to detect anomalous requests targeting the specific endpoint associated with this vulnerability. Regular audits of plugin code for proper use of WordPress capability functions such as current_user_can are also recommended to prevent similar authorization flaws in custom developments or third-party extensions.