Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/75a86686-ce21-4ba6-bf39-74aacf5ca4a9 İstismar kodu ya da analiz

Kayıt geçmişi

1. 1 Kas 2026 20:40CVSS puanı değişti: – → 4.3
2. 1 Kas 2026 09:00Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-107342Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure
• 4,3 CVE-2026-113481Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields
• 6,5 CVE-2026-103997Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via…
• 4,3 CVE-2025-11455Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement
• 5,9 CVE-2026-110023WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter
• 5,3 CVE-2026-11396Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter