CVE-2026-14206: HT Contact Form Information Disclosure

CVE-2026-14206 Overview

CVE-2026-14206 is an information disclosure vulnerability affecting the HT Contact Form WordPress plugin in versions before 2.9.3. The plugin exposes an endpoint that returns saved form drafts without performing any authorization check. Unauthenticated remote attackers can query this endpoint to read personal data stored in form drafts, including names, email addresses, phone numbers, and physical addresses. The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Unauthenticated attackers can harvest personally identifiable information (PII) from any WordPress site running a vulnerable version of the HT Contact Form plugin, creating direct privacy and regulatory compliance exposure.

Affected Products

HT Contact Form WordPress plugin versions prior to 2.9.3
WordPress sites installing the HT Contact Form plugin from the WordPress plugin repository
Any deployment persisting contact form drafts through the vulnerable plugin

Discovery Timeline

2026-08-10 - CVE-2026-14206 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-14206

Vulnerability Analysis

The HT Contact Form plugin stores partially completed submissions as drafts so users can resume filling them out later. Retrieval of these drafts is exposed through a plugin endpoint that returns the stored draft payload as structured data. The endpoint fails to enforce any authorization or ownership check on the requesting client. As a result, any anonymous HTTP client that can reach the WordPress site can request stored drafts and receive the personal data contained within them.

Because the endpoint is network-reachable, requires no authentication, and needs no user interaction, mass enumeration is straightforward. Attackers can script requests across draft identifiers to bulk-extract PII from vulnerable sites.

Root Cause

The root cause is a missing authorization control on the draft-retrieval endpoint. The endpoint reads a draft record and returns it to the caller without validating that the caller owns the draft, holds an authenticated session, or possesses a valid nonce. This maps to [CWE-200] and, more specifically, to broken access control on a REST/AJAX handler.

Attack Vector

An attacker sends unauthenticated HTTP requests to the vulnerable plugin endpoint and iterates through draft identifiers. Each successful response returns the raw contents of a stored draft, including submitter name, email, phone number, and address. No exploit code, elevated privileges, or user interaction is required. Details of the endpoint and request format are documented in the WPScan Vulnerability Advisory.

No public proof-of-concept exploit or exploitation in the wild has been confirmed at the time of publication.

Detection Methods for CVE-2026-14206

Indicators of Compromise

Unauthenticated HTTP requests to HT Contact Form plugin endpoints returning draft data, particularly requests iterating sequential draft identifiers from a single source IP.
Elevated request volume against /wp-admin/admin-ajax.php or plugin REST routes referencing the HT Contact Form plugin from unauthenticated sessions.
Access log entries showing HTTP 200 responses with JSON payloads containing email, phone, or address fields from requests without valid wordpress_logged_in_* cookies.

Detection Strategies

Inventory WordPress installations and identify sites running HT Contact Form at a version below 2.9.3 using plugin management tooling or direct filesystem inspection of wp-content/plugins.
Deploy web application firewall (WAF) rules that flag unauthenticated calls to the plugin's draft-retrieval endpoint and alert on enumeration patterns.
Correlate WordPress access logs against a baseline of authenticated draft retrieval activity to surface anomalous unauthenticated traffic.

Monitoring Recommendations

Monitor egress volumes of JSON responses from admin-ajax.php and plugin REST routes for spikes consistent with bulk PII extraction.
Alert on repeated sequential-ID access patterns from a single source, which typically indicates enumeration of draft identifiers.
Route WordPress and WAF logs into a centralized analytics pipeline to enable retrospective hunts once the endpoint path is confirmed from the WPScan advisory.

How to Mitigate CVE-2026-14206

Immediate Actions Required

Upgrade the HT Contact Form plugin to version 2.9.3 or later on every WordPress site in the environment.
Audit stored form drafts and consider purging historical draft records that may already have been exposed to unauthenticated retrieval.
Review web server access logs for prior unauthenticated hits against the plugin's draft endpoint and treat matching submitter data as potentially disclosed.

Patch Information

The vendor addressed the missing authorization check in HT Contact Form version 2.9.3. Administrators should apply this update through the WordPress plugin updater or by replacing the plugin directory with the fixed release. Refer to the WPScan Vulnerability Advisory for advisory-level details.

Workarounds

If immediate patching is not possible, deactivate and remove the HT Contact Form plugin until the fixed version can be deployed.
Block unauthenticated requests to the plugin's draft-retrieval endpoint at the WAF or reverse proxy layer using URL and parameter matching.
Restrict access to wp-admin/admin-ajax.php actions associated with the plugin to authenticated sessions only through server-level rules.

bash

# Configuration example: block unauthenticated access to the HT Contact Form
# draft endpoint at the nginx layer until the plugin is upgraded to 2.9.3.
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "htcf.*draft") {
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
}