Unauthenticated Draft Data Exposure in HT Contact Form WordPress Plugin

Executive Summary

This vulnerability affects the HT Contact Form WordPress plugin before version 2.9.3. It allows unauthenticated users to access saved form drafts containing personal data like names, emails, phone numbers, and addresses due to missing authorization checks on the draft retrieval endpoint.

Useful 0 Not Useful 0

Detection Guidance

Check if your HT Contact Form plugin version is below 2.9.3. Inspect network traffic for unauthorized access to draft endpoints or unusual requests to retrieve form draft data.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could read sensitive personal data stored in form drafts, potentially exposing names, emails, phone numbers, and physical addresses of users who saved drafts. This could lead to privacy breaches or targeted phishing attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations by exposing personal data without authorization. Organizations using the vulnerable plugin may face compliance violations, legal penalties, and reputational damage due to unauthorized data access.

Useful 0 Not Useful 0

Mitigation Strategies

Update the HT Contact Form plugin to version 2.9.3 or later immediately. Review and restrict access to sensitive draft data endpoints.

Useful 0 Not Useful 0