Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107342— Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure

Quick assessment

Affected
Unknown Kali Forms — Contact Form & Drag-and-Drop Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kali Forms — Contact Form & Drag-and-Drop Builder WordPress 插件在 2.4.30 版本之前，其测试邮件处理程序在解析并返回用户电子邮件地址时未执行权限检查，仅依赖一个对任何已登录用户都可见的 nonce（一次性令牌）。这导致拥有最低权限的已认证用户（订阅者及以上）能够泄露任意已注册用户（包括管理员）的电子邮件地址。

AI Predicted 5.3 Difficulty: Easy EPSS 0.14% · P3

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown Kali Forms — Contact Form & Drag-and-Drop Builder < 2.4.30 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107342

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Kali Forms — Contact Form & Drag-and-Drop Builder 0 ~ 2.4.30 -

II. Public POCs for CVE-2026-107342

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107342

请登录查看更多情报信息。

Other References for CVE-2026-107342 (1)

Same Patch Batch · Unknown · 2026-11-01 · 5 CVEs total

CVE-2026-118168 MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure
CVE-2026-113482 Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode
CVE-2026-113481 Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fie
CVE-2026-107343 Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing

IV. Related Vulnerabilities

Same product: Kali Forms — Contact Form & Drag-and-Drop Builder
Same vendor: Unknown