Executive Summary
CVE-2026-14206 is a broken access control vulnerability in the HT Contact Form WordPress plugin, affecting all versions prior to 2.9.3. The flaw allows any unauthenticated user on the internet to call an internal API endpoint that returns saved form drafts — exposing the personal data of anyone who submitted a contact form on the affected site.
CVSS v3.1 Score: 7.5 (HIGH)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published to the National Vulnerability Database on August 10, 2026, this vulnerability requires no credentials, no special privileges, and no user interaction to exploit.
Vulnerability Overview
Root Cause
The vulnerable component is the backend API endpoint responsible for retrieving saved contact form drafts. The endpoint performs no authorization check of any kind — it does not verify whether the requesting party is authenticated, let alone whether they own the draft being requested. Any network-accessible request will return the stored draft data.
CWE Classification: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Data Exposed
Contact form drafts commonly collect and store:
| Field | Exposure Risk |
|---|---|
| Full name | PII |
| Email address | PII |
| Phone number | PII |
| Physical address | Sensitive PII |
| Message content | Context-dependent |
Depending on how a site's contact form is configured, this endpoint could expose highly sensitive personal information submitted by visitors, customers, or service inquirers.
Technical Details
Attack Complexity
Exploitation requires only a single unauthenticated HTTP request to the vulnerable endpoint. The attack:
- Is network-accessible (no local access needed)
- Requires no privileges (unauthenticated)
- Requires no user interaction
- Has low complexity — a basic HTTP client suffices
- Results in high confidentiality impact
A proof-of-concept is confirmed to exist per the NVD entry published alongside this CVE.
CVSS Breakdown
Attack Vector: Network (AV:N)
Attack Complexity: Low (AC:L)
Privileges Required: None (PR:N)
User Interaction: None (UI:N)
Scope: Unchanged (S:U)
Confidentiality Impact: High (C:H)
Integrity Impact: None (I:N)
Availability Impact: None (A:N)
Affected Versions
| Version | Affected |
|---|---|
| All versions prior to 2.9.3 | Yes |
| 2.9.3 and later | No — Patched |
Remediation
Immediate Action
Update HT Contact Form to version 2.9.3 or later via your WordPress admin dashboard:
- Navigate to Plugins → Installed Plugins
- Locate HT Contact Form
- Click Update Now (if the update is not yet showing, click Check for Updates first)
- Verify the installed version is 2.9.3 or greater
Verify via WP-CLI
wp plugin get ht-contact-form --field=version
wp plugin update ht-contact-formIf Immediate Update Is Not Possible
If you cannot update immediately, consider temporarily deactivating the plugin until the patch can be applied. This removes the exposure at the cost of contact form functionality.
GDPR and Privacy Compliance Implications
For sites operating under GDPR, PIPEDA, CCPA, or other privacy regulations, this vulnerability may constitute a reportable data breach if exploitation is suspected or confirmed. Key considerations:
- GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a breach
- GDPR Article 34 may require notification of affected data subjects if the breach is likely to result in high risk
- Conduct an internal assessment of whether the plugin's draft endpoint was exposed and whether any external parties accessed it
Detection
WordPress administrators should audit server logs for unexpected requests to the plugin's draft retrieval endpoint. Any request pattern showing access to this endpoint from unauthenticated or unknown sources should be investigated.
Log Review (Apache/Nginx)
Look for GET requests targeting the plugin's REST or admin-ajax endpoints in your web server access logs. Patterns to look for include repeated requests from the same IP to AJAX endpoints associated with contact form draft retrieval.