Kali Forms CVE-2026-107343

Requires an authenticated session for any low-privileged role (Subscriber or above) on a site running Kali Forms - Contact Form & Drag-and-Drop Builder before 2.4.30; the attacker needs only a valid logged-in nonce, which the plugin exposes to any authenticated user, and no administrative capability. No non-default plugin configuration is described as necessary - the test-email handler lacks the capability check by default. The practical limiting factor is that the attacker must be able to log in: open user registration (common on many WordPress sites) or possession of any existing account satisfies this, so unauthenticated exploitation is not possible. Impact is limited to sending email to an arbitrary recipient with a spoofed sender address (abuse for spam/phishing relay), not server compromise.

This is a genuinely low-to-moderate priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity flaw requiring low privileges (PR:L) - i.e. any authenticated low-privileged account such as a Subscriber - with no user interaction and only a limited integrity impact (C:N, A:N). This matches the description precisely: a missing capability check (CWE-862) on the test-email handler that is gated only by a logged-in nonce. The exploitation signals all point away from urgency: EPSS is 0.13% (3rd percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and the vuln is NOT on the CISA KEV list. The only exploit signal is a WPScan reference that is not verified as working exploit code, so active exploitation is not indicated. The vendor priority label is 'this_month', which aligns with a patch-when-convenient posture rather than an emergency. Net: a real but bounded abuse-of-functionality flaw (authenticated email spoofing/relay), not a high-impact RCE despite being network-exploitable.

An attacker who holds or registers a low-privileged account (e.g. Subscriber) on a WordPress site running Kali Forms before 2.4.30 calls the plugin's test-email handler, which only validates a nonce available to any logged-in user and never checks capability. Because AV:N/AC:L/PR:L/UI:N, the request is a simple authenticated HTTP call with no special timing or interaction. A public PoC reference exists via WPScan; it is not verified as working exploit code.