Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-14206

HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown HT Contact Form

Default version status: unaffected

  • 0 to < 2.9.3affected

References