Data Exposure Vulnerability in HT Contact Form Plugin by WordPress
CVE-2026-14206
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14206?
The HT Contact Form plugin for WordPress fails to implement authorization checks on its endpoint that retrieves saved form drafts. This oversight permits any unauthenticated user to access sensitive information, such as names, email addresses, phone numbers, and physical addresses stored in these drafts. Such vulnerabilities can lead to significant privacy breaches and unauthorized data access, highlighting the need for robust security measures in web applications.
Affected Version(s)
HT Contact Form 0 < 2.9.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.