high7.5
CVE-2026-14206
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenti…
Impact
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
Affected products
| Product | Affected versions |
|---|---|
| HT Contact Form WordPress Plugin | before 2.9.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.