Unauthorized Email Disclosure in Kali Forms Plugin for WordPress
CVE-2026-107342
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 1 November 2026
Badges
What is CVE-2026-107342?
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin prior to version 2.4.30 is vulnerable to improper access control. This issue arises when the plugin's test-email handler processes requests without adequately checking user capabilities. It leverages a nonce that any logged-in user can obtain, resulting in a scenario where authenticated users with minimal privileges can disclose the email addresses of any registered users, including those with higher administrative rights. This vulnerability poses a significant risk to user privacy and security within WordPress websites.
Affected Version(s)
Kali Forms — Contact Form & Drag-and-Drop Builder 0 < 2.4.30
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.