Kali Forms, a WordPress plugin that provides contact forms and drag-and-drop builders, fails to enforce a capability check when its test‑email handler resolves a user's email address. The endpoint relies solely on a nonce that any logged‑in user can request, so any authenticated user with a Subscriber role or higher can learn the email address of any registered user, including administrators. This flaw amounts to an information disclosure that reveals sensitive personal data without authorization.

The affected product is the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin, specifically all releases prior to 2.4.30. Users running these older versions on their WordPress installations are vulnerable; no specific vendor or product versions beyond the plugin name and version cutoff are listed.

The vulnerability is exploitable by any authenticated user, which is a wide attack surface because even low privileged roles can trigger the disclosure. No EPSS score is available, but the lack of a capability check indicates that the flaw can be triggered without additional conditions. The CVSS score is not provided, but the impact is limited to information exposure rather than remote code execution. Since the flaw is not listed in CISA’s KEV catalog, there is no current evidence of active exploitation, yet the convenience of the endpoint means that a malicious actor with an account could easily gather user email addresses if the plugin remains unpatched.