CVE-2025-12895

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12895", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-07T18:51:08.718Z", "datePublished": "2026-01-15T13:23:24.228Z", "dateUpdated": "2026-04-08T16:35:28.436Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:28.436Z"}, "affected": [{"vendor": "Laborator", "product": "Kalium 3 | Creative WordPress & WooCommerce Theme", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.29", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf."}], "title": "Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0e65a794-1901-4e54-be4f-9422fe444057?source=cve"}, {"url": "https://themeforest.net/item/kalium-creative-theme-for-professionals/10860525"}, {"url": "https://documentation.laborator.co/kb/kalium/kalium-changelog/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ahmed Rayen Ayari"}], "timeline": [{"time": "2025-12-05T21:29:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-15T01:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T15:35:09.194170Z", "id": "CVE-2025-12895", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T15:35:48.668Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12895", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-15T15:35:09.194170Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T15:35:45.985Z"}}], "cna": {"title": "Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request", "credits": [{"lang": "en", "type": "finder", "value": "Ahmed Rayen Ayari"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "Laborator", "product": "Kalium 3 | Creative WordPress & WooCommerce Theme", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.29"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-05T21:29:14.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-15T01:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0e65a794-1901-4e54-be4f-9422fe444057?source=cve"}, {"url": "https://themeforest.net/item/kalium-creative-theme-for-professionals/10860525"}, {"url": "https://documentation.laborator.co/kb/kalium/kalium-changelog/"}], "descriptions": [{"lang": "en", "value": "The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-15T13:23:24.228Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12895", "state": "PUBLISHED", "dateUpdated": "2026-01-15T15:35:48.668Z", "dateReserved": "2025-11-07T18:51:08.718Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-15T13:23:24.228Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Kalium 3 | Creative WordPress & WooCommerce Theme", "vendor": "Laborator", "versions": [{"lessThanOrEqual": "3.29", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf."}, {"lang": "es", "value": "El tema Kalium 3 | Creative WordPress &amp; WooCommerce Theme para WordPress es vulnerable al env\u00edo no autorizado de correos electr\u00f3nicos debido a una falta de verificaci\u00f3n de capacidad en la funci\u00f3n kalium_vc_contact_form_request() en todas las versiones hasta la 3.29, inclusive. Esto hace posible que atacantes no autenticados utilicen el tema como un rel\u00e9 de correo abierto y env\u00eden correos electr\u00f3nicos a direcciones de correo electr\u00f3nico arbitrarias en nombre del servidor."}], "id": "CVE-2025-12895", "lastModified": "2026-06-17T08:33:09.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12895", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-15T15:35:09.194170Z", "version": "2.0.3"}}]}, "published": "2026-01-15T14:16:25.540", "references": [{"source": "security@wordfence.com", "url": "https://documentation.laborator.co/kb/kalium/kalium-changelog/"}, {"source": "security@wordfence.com", "url": "https://themeforest.net/item/kalium-creative-theme-for-professionals/10860525"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0e65a794-1901-4e54-be4f-9422fe444057?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:41:05.363000+00:00", "value": {"mitigation_remediation": ["Upgrade the Kalium theme to the latest stable release (3.30 or newer) that includes the missing capability check.", "Temporarily disable the kalium_vc_contact_form_request functionality or remove the contact form from the site until an official patch is applied.", "Restrict outgoing email by configuring WordPress to use a dedicated SMTP gateway that validates recipient domains, or install a plugin that limits SMTP recipients to a whitelist.", "Review theme files for unauthorized modifications and apply regular security audits to detect similar authorization gaps."], "summary": {"action": "Patch Urgently", "impact": "Unauthorized Email Relay"}, "threat_synthesis": {"affected_systems": "All installations of the Kalium 3 Creative WordPress & WooCommerce Theme running version 3.29 or earlier are vulnerable. The issue affects the theme component of WordPress sites that have not applied any patch or upgrade. The vulnerability is linked to the Kalium theme released by Laborator and broadly used on WordPress and WooCommerce sites. No specific WordPress core version is required for exploitation; the defect resides purely in the theme's PHP code.", "description_and_impact": "The Kalium 3 Creative WordPress & WooCommerce Theme contains a missing capability check within the kalium_vc_contact_form_request function. Unauthenticated users can trigger this endpoint and cause the server to send e\u2011mail to any address they provide. As a result, attackers can use the site as an open mail relay to distribute spam, phishing messages, or otherwise abuse the site\u2019s mail transport for malicious purposes. Because the vulnerability relies on a simple HTTP request, no authentication is required, and the consequences apply to all users of the affected theme.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a medium impact, while the EPSS score of less than 1% signals a low likelihood of being targeted in the near term. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would likely target the standard contact form or a custom endpoint that forwards the request to the backend. Because the flaw is purely a missing authorization check, the exploitation path is straightforward: an unauthenticated HTTP request to the kalium_vc_contact_form_request route with a crafted recipient address. If exploited, an attacker can send email to arbitrary addresses without the server owner\u2019s knowledge."}}}}, "created": "2026-01-16T13:43:29.158280+00:00", "updated": "2026-04-22T15:45:20.873348+00:00", "vendors": ["laborator", "laborator$PRODUCT$kalium", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}