Skip to content
Sign in
4.3 Medium

CVE-2026-107342 The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check…

Description

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.

Affected products and versions

Product Affected versions Fixed in
Kali Forms — Contact Form & Drag-and-Drop Builder 2.4 earliest → < 2.4.30 2.4.30

Other CVEs of Kali Forms — Contact Form & Drag-and-Drop Builder

The 6 CVEs of Kali Forms — Contact Form & Drag-and-Drop Builder →
CVE-2026-106649 Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action 6.8 Medium CVE-2026-107343 The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check… 4.3 Medium CVE-2026-11580 The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object… 5.5 Medium CVE-2026-11579 The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file… 5.3 Medium
Track this CVE