CVE-2025-12895: Kalium WordPress Theme Auth Bypass Flaw

CVE-2025-12895 Overview

CVE-2025-12895 affects the Kalium Creative WordPress & WooCommerce Theme through version 3.29. The vulnerability stems from a missing capability check on the kalium_vc_contact_form_request() function. Unauthenticated attackers can invoke this function to send email messages to arbitrary recipients using the affected site as a relay. The flaw is categorized under [CWE-862] Missing Authorization. Successful abuse turns the WordPress installation into an open mail relay, harming sender reputation and enabling phishing campaigns originating from a trusted domain.

Critical Impact
Unauthenticated attackers can use vulnerable Kalium installations as an open mail relay to send arbitrary emails on the server's behalf.

Affected Products

Kalium Creative WordPress & WooCommerce Theme versions up to and including 3.29
WordPress sites running the Laborator Kalium theme
Sites using the Kalium Visual Composer contact form integration

Discovery Timeline

2026-01-15 - CVE-2025-12895 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12895

Vulnerability Analysis

The Kalium theme exposes the kalium_vc_contact_form_request() function through a WordPress AJAX endpoint. The function processes contact form submissions and dispatches email through the WordPress wp_mail() pipeline. The handler does not validate the caller's capabilities or restrict recipient addresses. Attackers can therefore submit crafted requests directly to the endpoint without authentication. The request is treated as a legitimate contact form submission, and email is sent using the web server's configured mail transport. Because the message originates from the victim's domain, it inherits any SPF, DKIM, or DMARC trust associated with that server.

Root Cause

The root cause is a missing authorization check on a publicly reachable handler. WordPress allows unauthenticated users to call the wp_ajax_nopriv_ action that maps to kalium_vc_contact_form_request(). The function does not enforce a nonce validation, capability check, or recipient allowlist. Recipient values supplied in the request body are accepted without server-side restriction to a predefined contact address.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP POST request to the WordPress AJAX endpoint with the Kalium contact form action and attacker-controlled recipient, subject, and body parameters. The server processes the request and delivers email to the supplied address. Attackers can script this request to generate large volumes of outbound mail, embed phishing content, or spoof internal communications using the victim's domain.

No verified proof-of-concept code is published. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-12895

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php referencing the Kalium contact form action from external IP addresses at high frequency
Outbound wp_mail() activity addressed to recipients outside the site's normal contact distribution
Mail server logs showing surges in messages sent from the WordPress host to unrelated external domains
SMTP bounce notifications for recipients that the site administrator does not recognize

Detection Strategies

Inspect web access logs for unauthenticated POST traffic to admin-ajax.php with the Kalium contact form action parameter
Correlate WordPress AJAX requests with outbound SMTP volume to identify relay abuse patterns
Alert on contact form submissions where the recipient field deviates from the site's configured address

Monitoring Recommendations

Forward web server, WordPress audit, and SMTP logs to a centralized analytics platform for correlation
Track outbound mail volume per sending host and alert on deviations from baseline
Monitor domain reputation services and DMARC aggregate reports for unexpected sending activity

How to Mitigate CVE-2025-12895

Immediate Actions Required

Identify all WordPress installations running the Kalium theme and confirm the installed version against the changelog
Update Kalium to a release later than 3.29 once the vendor publishes a fix
Restrict access to /wp-admin/admin-ajax.php from anonymous sources where business requirements allow
Rotate any mail server credentials if relay abuse is suspected and review outbound mail logs

Patch Information

Review the Kalium Changelog Documentation for the latest theme release information. Confirm vendor fix availability through the ThemeForest Kalium Theme Info listing before upgrading.

Workarounds

Deploy a web application firewall rule that blocks unauthenticated requests to the Kalium contact form AJAX action
Configure the mail transport agent to restrict outbound recipients to approved domains where feasible
Temporarily disable the Kalium contact form module until a patched theme version is installed

bash

# Example WAF rule concept for ModSecurity
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1012895,msg:'Block Kalium contact form abuse'"
SecRule ARGS:action "@streq kalium_vc_contact_form_request" \
  "chain"
SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"