Vulnerability · Published Jan 15, 2026 · Assigned by Wordfence

CVE-2025-12895Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request

Medium 5.3

In plain English

A medium-severity missing authorization in Kalium 3 | Creative WordPress & WooCommerce Theme from Laborator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf.

Affected products (as reported)

Vendor	Product	Versions
Laborator	Kalium 3 \| Creative WordPress & WooCommerce Theme	0 – through 3.29

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References