TI-2026-83584 Aliases CVE-2026-107342 GHSA-3h5r-7p7q-xv68

Kali Forms plugin lets subscribers read user email addresses

LOW 19CWE-200Published 2026-11-01 · Updated 2026-11-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.

Summary

The Kali Forms Contact Form and Drag-and-Drop Builder WordPress plugin before 2.4.30 does not check user capabilities in its test-email handler (CWE-200). The handler relies only on a nonce that any logged-in user holds, so an authenticated user with Subscriber role or higher can retrieve the email address of any registered user, including administrators. The references include a link to an exploit.

Written with Claude Haiku 5.5 from the sources below · 2026-11-01

Description from the CNA

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00176 7th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Kali Forms — Contact Form & Drag-and-Drop Builder (Unknown): 2.4.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Kali Forms — Contact Form & Drag-and-Drop Builder	before 2.4.30	2.4.30	Patch available	CNA

Kali Forms — Contact Form & Drag-and-Drop Builder VendorUnknown Affected before 2.4.30 Fixed in 2.4.30 Patch available CNA

Remediation

Update Kali Forms to version 2.4.30 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-01

Fix · CNA Kali Forms — Contact Form & Drag-and-Drop Builder (Unknown) Fixed in 2.4.30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-11-01
Kali Forms — Contact Form & Drag-and-Drop Builder 2.4.30
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-83585 Missing authorization in Kali Forms lets subscribers send spoofed emailPriority LOW 19
Show all 2 records →

Timeline

2026-11-01 Threatist record created from CVE-2026-107342
2026-11-01 Alias added: GHSA-3h5r-7p7q-xv68
2026-11-01 CVSS score added · CISA ADP
2026-11-01 Weakness changed · CISA ADP
2026-11-01 CISA SSVC decision points changed

References

Exploit 1

https://wpscan.com/vulnerability/b315203f-0755-4c33-9335-88f788cb1fd7/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences