CVE-2026-14206

The vulnerability is in the HT Contact Form WordPress plugin before version 2.9.3. The endpoint that returns a saved form draft does not perform any authorization checks, enabling unauthenticated access to exposed personal data (name, email, phone, address) stored in drafts. This is the root caus...