Vulnerability record/PUBLISHED/Published Nov 1, 2026 06:00:22 UTC
CVE-2026-107343
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 1, 2026 06:00:22 UTC
PublishedNov 1, 2026 06:00:22 UTC
ReservedOct 7, 2026 18:56:03 UTC
Credits
- Sai Praneeth Koti
- WPScan