Public vulnerability disclosure
CVE-2026-107342
CVE-2026-107342
publishedCWE-200
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.
Technical severity4.3 mediumCVSS 3.1 · NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Published2026-11-01Source updated 2026-11-01
Collected2026-11-021 attributed source
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
No affected-product ranges reported in collected sources.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 4.3 medium |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.