WordPress Plugin Vulnerabilities
Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter
Description
The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or JSON format via the 'export_data' parameter.
Affects Plugins
No known fix References
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Legion Hunter
Verified
No
WPVDB ID
Timeline
Publicly Published
2025-12-04 (about 9 months ago)
Added
2025-12-04 (about 9 months ago)
Last Updated
2025-12-05 (about 9 months ago)
WPScan 