WordPress Plugin Vulnerabilities

HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure

Description

The plugin does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.

Proof of Concept

Affects Plugins

Plugin icon
ht-contactform
Fixed in 2.9.3

References

CVE
CVE-2026-14206

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Mustafa Ahmed
Submitter
Mustafa Ahmed
Submitter website
https://fortressmssp.com
Verified
Yes
WPVDB ID
36ae857c-6812-46e0-a0e7-6c868108ef39

Timeline

Publicly Published
2026-08-06 (about 4 days ago)
Added
2026-08-06 (about 3 days ago)
Last Updated
2026-08-06 (about 3 days ago)

Other

Published
Title
Published
2025-09-22
Title
3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery < 1.16.17 - Unauthenticated Sensitive Information Exposure
Published
2025-10-16
Title
MasterStudy LMS < 3.6.21 - Authenticated (Instructor+) Sensitive Information Exposure
Published
2024-08-09
Title
myCred < 2.7.3 - Unauthenticated Information Exposure
Published
2024-08-29
Title
Masterstudy LMS Starter < 1.1.9 - Unauthenticated Sensitive Information Exposure
Published
2026-04-29
Title
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe < 29.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure