CVE-2026-14206 HT CVE debrief

Who should care

Users of the HT Contact Form WordPress plugin, especially those with sensitive information in form drafts, should be aware of this vulnerability. Operators, platform administrators, and security teams need to assess their exposure and take appropriate actions to protect their environments. Vulnerability management and security teams should prioritize patching and monitoring for this issue. Security teams should also review compensating controls for exposed systems and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Technical summary

The HT Contact Form WordPress plugin before 2.9.3 lacks authorization checks on endpoints returning saved form drafts. Unauthenticated users can access personal data (name, email, phone, address) stored in form drafts. This issue allows unauthorized users to read sensitive information stored in form drafts, potentially leading to privacy breaches. The vulnerability can be mitigated by updating to plugin version 2.9.3 or later and monitoring for unauthorized access attempts.

Defensive priority

Unauthenticated users can access personal data stored in form drafts. Verify and restrict access to form endpoints.

Recommended defensive actions

• Verify and restrict access to form endpoints
• Update to plugin version 2.9.3 or later
• Monitor for unauthorized access attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The HT Contact Form WordPress plugin before 2.9.3 does not perform authorization checks on saved form draft endpoints. Limited information available. To verify, defenders should check plugin versions, review form draft access controls, and monitor for unauthorized access attempts. The vulnerability allows unauthenticated users to access personal data stored in form drafts, potentially leading to privacy breaches. Defenders should verify the plugin version, review form draft access controls, and monitor for unauthorized access attempts to protect their environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.