The Kalium 3 WordPress theme contains a missing authorization vulnerability (CWE-862) in the kalium_vc_contact_form_request() function. This flaw permits unauthenticated users to send arbitrary emails through the server hosting the theme, effectively using it as an open mail relay. The vulnerability affects all versions up to 3.29. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity (unauthorized email sending). No patch or vendor advisory is currently provided.

An attacker can exploit this vulnerability to send unauthorized emails from the affected server, potentially facilitating spam or phishing campaigns that appear to originate from a legitimate source. The integrity of email communications is compromised, but there is no direct impact on confidentiality or availability reported. This could lead to reputational damage or blacklisting of the server's email domain.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling or restricting access to the vulnerable contact form functionality or implement additional access controls at the web server or application level to prevent unauthenticated use. Monitoring for unusual email sending patterns may help detect exploitation attempts.