CVE-2026-107343 in Kali Forms Plugin
Summary
by MITRE • 11/01/2026
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in Kali Forms — Contact Form & Drag-and-Drop Builder for WordPress prior to version 2.4.30 represents a critical authentication bypass and authorization flaw within the plugin's administrative functionality. Specifically, the test-email handler endpoint fails to enforce proper capability checks that restrict access to users with elevated privileges, such as Administrators or Editors. Instead of verifying that the requesting user possesses specific permissions required for sending system-level emails, the implementation relies exclusively on a nonce verification mechanism. While nonces are designed to prevent Cross-Site Request Forgery attacks by ensuring requests originate from legitimate pages within the application session, they do not inherently validate the authority of the user making the request if those nonces are accessible to lower-privileged roles.
In WordPress environments, certain administrative features generate nonces that are available to any authenticated user upon page load or through standard API interactions. In this specific case, a low-privileged account with minimal rights, such as a Subscriber role, can obtain the necessary nonce and subsequently craft requests to the test-email endpoint. Because the backend logic does not cross-reference the request against capability requirements like manage_options or edit_posts for administrative actions, it accepts the input from unauthorized users. This architectural oversight allows an attacker who has compromised even a basic user account on the WordPress site to interact with sensitive functionality intended only for high-privilege administrators.
The operational impact of this vulnerability is significant due to its potential for abuse in spam campaigns and phishing attacks. An authenticated low-privileged user can exploit this flaw to send emails to arbitrary recipients using spoofed sender addresses that appear to originate from the WordPress site itself. This capability effectively turns the compromised website into a relay server for malicious communications. Attackers can leverage this vector to distribute malware, conduct credential harvesting via deceptive email content, or damage the reputation of the affected organization by sending spam through their domain. The ability to spoof the sender address exacerbates the risk, as recipients are more likely to trust emails appearing to come from legitimate sources, thereby increasing the success rate of social engineering attacks.
From a classification perspective, this issue aligns with CWE-269 Improper Privilege Management and CWE-352 Cross-Site Request Forgery (CSRF), although it is primarily an authorization failure rather than a pure CSRF exploit since it involves authenticated users. In the context of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1078 Valid Accounts, where attackers leverage existing credentials with insufficient privileges to perform actions outside their intended scope, and potentially T1534 Internal Spearphishing if used internally or T1602 Data from Configuration Repositories if the email content is harvested. The vulnerability highlights a common pitfall in plugin development where nonce verification is mistakenly equated with full authorization control.
To mitigate this risk, immediate action must be taken to update the Kali Forms — Contact Form & Drag-and-Drop Builder plugin to version 2.4.30 or later, where these capability checks have been properly implemented. For organizations unable to patch immediately due to compatibility concerns, temporary mitigations should include restricting access to WordPress admin areas via IP whitelisting if feasible and monitoring outgoing email logs for anomalies indicative of abuse. Additionally, implementing strict Content Security Policy headers and ensuring that all administrative endpoints enforce role-based access control checks alongside nonce verification is essential for hardening the application against similar authorization bypasses in future updates or other plugins.