The vulnerability allows a logged‑in user with minimal privileges, such as a Subscriber, to trigger the plugin’s test‑email endpoint without performing a capability check. Because the endpoint relies solely on a nonce, any authenticated user can cause the site to send an arbitrary email with a forged sender address. This enables phishing, spam, or other malicious email activity from the site’s domain, potentially harming its reputation and compromising users who receive such spoofed messages.

WordPress sites that use the Kali Forms – Contact Form & Drag‑and‑Drop Builder plugin in versions prior to 2.4.30 are affected. The vulnerability applies to any installation of this plugin where the test‑email feature remains enabled.

The exploitation requires only that the user be authenticated to the site; no additional network access or elevated permissions are necessary, so the attack vector is an HTTP request to the test‑email endpoint. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that it has not been observed as a widely exploited target yet. However, the lack of authorization controls permits an attacker to send spoofed emails, presenting a significant risk of phishing or domain spoofing. The absence of a CVSS score in the public data suggests that the severity may not yet be formally quantified, but the described impact warrants prompt remediation.