CVE-2026-14206

The CVSS 7.5 score for this unauthenticated PII disclosure masks a critical uncertainty: we don't know how the endpoint identifies which draft to return. If it accepts sequential IDs, an attacker could enumerate every saved draft. If it requires session-bound tokens, exposure is limited to drafts created during the attacker's session. That distinction determines whether you're facing a mass-breach scenario or a targeted leak—and the CVE provides no clarity on which applies. What we do know: the plugin's contact form category suggests the exposed data includes names, emails, phone numbers, and addresses. For business contact forms, this creates credential-harvesting potential. For healthcare or sensitive inquiry forms, the impact is worse. Assume the data is valuable to attackers regardless of your use case. The 'before 2.9.3' remediation is concerning for a different reason. You should verify whether 2.9.3 added authentication to this endpoint or removed it entirely. The difference matters: an authenticated endpoint suggests the developer understood the boundary and fixed it. Endpoint removal suggests they patched the symptom. If it's the latter, other unauthenticated endpoints in this plugin may carry the same architectural assumption. Consider auditing the plugin's full request surface, not just patching this one CVE. Finally, treat this as potentially post-exploitation disclosure. The 2026 filing date for a 'before 2.9.3' issue in an active plugin raises timing questions—either the finding was dormant or exploitation occurred before the patch. Prioritize the upgrade and audit server logs for unusual draft-access patterns, especially if you run any version before 2.9.3.

Reviewed through automated stages and approved by a human before publication.