Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/b315203f-0755-4c33-9335-88f788cb1fd7 İstismar kodu ya da analiz

Kayıt geçmişi

1. 1 Kas 2026 20:40CVSS puanı değişti: – → 4.3
2. 1 Kas 2026 09:00Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-107343Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing
• 5,3 CVE-2026-120233ag-ui-protocol ag-ui HttpAgent http.ts information disclosure
• 5,3 CVE-2026-118168MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure
• 5,3 CVE-2026-120192Presenton Desktop Authentication Middleware app_data information disclosure
• 5,3 CVE-2026-109367All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter
• 5,3 CVE-2026-103915Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter