Threats tagged 'ghsa-r3f9-h5m2-87ch'

The Kali Forms WordPress plugin before version 2.4.30 has a vulnerability where its test-email handler does not perform proper capability checks. Instead, it relies solely on a nonce accessible to any logged-in user, allowing low-privileged users such as Subscribers to send emails from the site with arbitrary recipients and spoofed sender addresses.