CVE-2026-14206 — HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure

CVE-2026-14206

HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure PUBLISHED

Description (CNA)

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.

Affected (CNA)

Vendor / product	Versions
Unknown / HT Contact Form	affected 0 before 2.9.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/36ae857c-6812-46e0-a0e7-6c868108ef39/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.