CVE-2026-107342

Full vulnerability record from the local CVENow database.

Description

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-01 05:18:56.717000

Last modified

2026-11-01 05:18:56.717000

View original CVE JSON

{
  "id": "CVE-2026-107342",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-01T05:18:56.717",
  "lastModified": "2026-11-01T05:18:56.717",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Kali Forms — Contact Form & Drag-and-Drop Builder",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.4.30",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/b315203f-0755-4c33-9335-88f788cb1fd7/",
      "source": "[email protected]"
    }
  ]
}