Ht Contact Form
Monthly
Unauthenticated access to saved form draft data in the HT Contact Form WordPress plugin (versions before 2.9.3) exposes personally identifiable information - including names, email addresses, phone numbers, and physical addresses - to any remote attacker without credentials. The plugin's draft-retrieval endpoint performs no authorization check, meaning any unauthenticated HTTP request can enumerate or retrieve stored draft submissions. A publicly available exploit exists, though EPSS remains low at 0.16%, suggesting limited widespread automated scanning to date but real feasibility for targeted data harvesting against sites using this plugin.
Unauthenticated access to saved form draft data in the HT Contact Form WordPress plugin (versions before 2.9.3) exposes personally identifiable information - including names, email addresses, phone numbers, and physical addresses - to any remote attacker without credentials. The plugin's draft-retrieval endpoint performs no authorization check, meaning any unauthenticated HTTP request can enumerate or retrieve stored draft submissions. A publicly available exploit exists, though EPSS remains low at 0.16%, suggesting limited widespread automated scanning to date but real feasibility for targeted data harvesting against sites using this plugin.