CVE-2026-14206

The HT Contact Form WordPress plugin (versions before 2.9.3 ) is vulnerable to an unauthenticated data disclosure vulnerability. The root cause is a lack of authorization checks on the endpoint that returns saved form drafts, allowing unauthorized users to read sensitive personal data such as nam...