CVSS
7.5
CVSS v3.1
EPSS
0.3%
Exploit Prediction Score
Published
August 10, 2026
Exploitability
EPSS probability 0.3%
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).