Kali Forms EUVD-2026-114775

Requires the Kali Forms - Contact Form & Drag-and-Drop Builder plugin at a version before 2.4.30, and an authenticated session with at least Subscriber-level privileges; the attacker then invokes the test-email handler with a nonce that is exposed to any logged-in user, so no administrative capability is needed. The exploitation is gated by needing a valid low-privilege account - most practical on sites that allow open user registration - and the impact is limited to disclosure of registered users' email addresses (no write access, no code execution). Fixed in 2.4.30; the vendor patch (updating the plugin) is the remediation stated in the sources.

This is a low-to-moderate severity information-disclosure issue (CVSS 4.3), and the available signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network-reachable exploitation by an authenticated low-privileged user with no user interaction, affecting confidentiality only - which matches the description of a Subscriber-level account disclosing registered users' email addresses. SSVC reinforces a measured posture: Exploitation=none (no observed active exploitation), Automatable=no, and Technical Impact=partial. EPSS is very low at 0.14% (3rd percentile), and the issue is not in CISA KEV, so there is no evidence of widespread or imminent exploitation. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with routine-but-not-urgent remediation. The one caveat worth flagging: the PR:L rating assumes the attacker already holds a minimal account, so the real-world risk is elevated specifically on sites that permit open/self-service user registration, where Subscriber access is trivial to obtain; on sites with no untrusted registered users the practical exposure is much lower. Overall this is a genuine but modest priority - a confidentiality-only leak of PII (email addresses), not a code-execution or takeover flaw.

An attacker registers (or already holds) a Subscriber-level account on a WordPress site running Kali Forms before 2.4.30, then issues a request to the plugin's test-email handler using a nonce any logged-in user can obtain. Because the handler performs no capability check, it resolves and returns the email address of any targeted registered user, including administrators, enabling PII harvesting or targeting of admin accounts for follow-on phishing. A public PoC reference exists (WPScan) but it is not verified as working exploit code.