PULSE
LIVE36signals / 24h
ES
FEED
ransomunsafe reclama a Presentations.AI · US · Technologyransomakira reclama a Alcast · Manufacturingransompanzer reclama a The Minor Food Group · TH · Agriculture and Food Productionransomakira reclama a One Vision Imaging · Healthcareransomakira reclama a i4 Solutions · Technologyransomglobal secret group reclama a MACOFIN HELLAS S.A. · GR · Financial Servicesransomqilin reclama a City of Winchester · US · Government & Defenseransomqilin reclama a B Wright Drywall · US · Manufacturingransomglobal secret group reclama a Cook Remodeling · US · Otherransomstorm reclama a Southern Metals · US · Manufacturingransomstorm reclama a TRP International · US · Otherransomstorm reclama a Supportive Insurance Services · US · Financial Servicesransomwallstreet reclama a T.RAD North America · US · Technologyransomwallstreet reclama a Black Hills Bentonite · US · Manufacturingransomunsafe reclama a Presentations.AI · US · Technologyransomakira reclama a Alcast · Manufacturingransompanzer reclama a The Minor Food Group · TH · Agriculture and Food Productionransomakira reclama a One Vision Imaging · Healthcareransomakira reclama a i4 Solutions · Technologyransomglobal secret group reclama a MACOFIN HELLAS S.A. · GR · Financial Servicesransomqilin reclama a City of Winchester · US · Government & Defenseransomqilin reclama a B Wright Drywall · US · Manufacturingransomglobal secret group reclama a Cook Remodeling · US · Otherransomstorm reclama a Southern Metals · US · Manufacturingransomstorm reclama a TRP International · US · Otherransomstorm reclama a Supportive Insurance Services · US · Financial Servicesransomwallstreet reclama a T.RAD North America · US · Technologyransomwallstreet reclama a Black Hills Bentonite · US · Manufacturing
← All CVEs
CVE WatchAug 10, 2026

CVE-2026-14206

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft,

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Aug 10, 2026 · Last modified: Aug 10, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.

Official references
Related CVEs

No related CVEs by CWE or product.