Threats tagged 'ghsa-25jm-cqq3-vxrf'

A vulnerability in the HT Contact Form WordPress plugin before version 2.9.3 allows unauthenticated users to access saved form drafts without authorization. This exposure includes personal data such as name, email, phone, and address. The flaw is due to missing authorization checks on the endpoint that returns saved drafts.