Email Spoofing Vulnerability in Kali Forms WordPress Plugin
CVE-2026-107343

Currently unrated

Key Information:

Vendor

WordPress
Status
Kali Forms — Contact Form & Drag-and-drop Builder
Vendor
CVE Published:
1 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-107343?

The Kali Forms plugin for WordPress, prior to version 2.4.30, contains a security flaw where it fails to conduct proper capability checks on its test email feature. This allows users with low privileges, such as Subscribers, to exploit a nonce available to any logged-in user. Consequently, they can send emails to arbitrary recipients with deceptive sender addresses, posing a significant risk of abuse and misuse.

Affected Version(s)

Kali Forms — Contact Form & Drag-and-Drop Builder 0 < 2.4.30

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-107343 - Proof of Concept

References

https://wpscan.com/vulnerability/75a86686-ce21-4ba6-bf39-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sai Praneeth Koti
WPScan
.