The Kalium 3 Creative WordPress & WooCommerce Theme contains a missing capability check within the kalium_vc_contact_form_request function. Unauthenticated users can trigger this endpoint and cause the server to send e‑mail to any address they provide. As a result, attackers can use the site as an open mail relay to distribute spam, phishing messages, or otherwise abuse the site’s mail transport for malicious purposes. Because the vulnerability relies on a simple HTTP request, no authentication is required, and the consequences apply to all users of the affected theme.

All installations of the Kalium 3 Creative WordPress & WooCommerce Theme running version 3.29 or earlier are vulnerable. The issue affects the theme component of WordPress sites that have not applied any patch or upgrade. The vulnerability is linked to the Kalium theme released by Laborator and broadly used on WordPress and WooCommerce sites. No specific WordPress core version is required for exploitation; the defect resides purely in the theme's PHP code.

The CVSS score of 5.3 indicates a medium impact, while the EPSS score of less than 1% signals a low likelihood of being targeted in the near term. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would likely target the standard contact form or a custom endpoint that forwards the request to the backend. Because the flaw is purely a missing authorization check, the exploitation path is straightforward: an unauthenticated HTTP request to the kalium_vc_contact_form_request route with a crafted recipient address. If exploited, an attacker can send email to arbitrary addresses without the server owner’s knowledge.