Description

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T07:16:46.710Z",
  "pubdate": "2026-08-10T07:16:46.710Z",
  "executiveSummary": "The HT Contact Form WordPress plugin before version 2.9.3 suffers from an improper authorization vulnerability affecting the endpoint responsible for retrieving saved form drafts. This security flaw allows unauthenticated remote attackers to bypass access controls and read sensitive personal data stored within form drafts, including names, email addresses, phone numbers, and physical addresses.\nThe risk implications are severe due to the exposure of Personally Identifiable Information (PII), which can lead to privacy violations, targeted phishing campaigns, or further compromise of user data. The attacker capabilities are limited to reading draft entries without requiring authentication, specific privileges, or complex interaction, as long as they can access the network-exposed endpoint.\nExploitation requirements are minimal, relying entirely on the lack of proper authorization checks within the vulnerable endpoint. Remediation requires updating the affected HT Contact Form plugin to version 2.9.3 or higher, where proper access controls are enforced.",
  "technicalDetails": "The vulnerability resides within the HT Contact Form WordPress plugin affecting all versions prior to 2.9.3. The root cause of the issue stems from an absence of proper authorization checks on the specific endpoint responsible for returning saved form drafts. In software security terms, this represents an Access Control vulnerability where the application fails to validate whether the requesting entity possesses the necessary permissions or session context to access sensitive data structures.\nThe vulnerable component is the AJAX or REST endpoint designed to handle form draft retrieval. Because the endpoint does not implement authentication or capability checks (such as verifying user roles or session nonces), any unauthenticated HTTP client can issue a direct request to this endpoint over the network.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies or crafts a request to the vulnerable form draft retrieval endpoint exposed by the plugin. Due to the complete lack of input authorization validation, the server processes the incoming request without verifying the identity or privileges of the sender. The application queries the database or storage mechanism for saved form drafts and serializes the retrieved data in the HTTP response. Consequently, the response payload returns sensitive personal data submitted by users, including names, email addresses, phone numbers, and physical addresses.\nThe post-exploitation impact centers on unauthorized data exfiltration. Attackers can harvest large volumes of PII stored in form drafts, facilitating downstream attacks such as spear-phishing, identity theft, or social engineering. The vulnerability is entirely network-exposed and can be exploited repeatedly via automated scripts without user interaction or specialized privileges."
}