CVE-2025-13528CWE-862broken-access-control

CVE-2025-13528

Medium · published December 5, 2025

CVSS v3.1

5.3

EPSS

Percentile

59.2

In the wild

Unconfirmed

What it is

The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or JSON format via the 'export_data' parameter.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00896 · 59.2th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2025-12-05T11:16Z

References (3)

https://plugins.trac.wordpress.org/browser/feedback-modal-for-website/tags/1.0.1/inc/admin/main.php#L1011 · [email protected]https://plugins.trac.wordpress.org/browser/feedback-modal-for-website/trunk/inc/admin/main.php#L1011 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/f3341c29-a69e-4618-a8a5-11f4141ff88f?source=cve · [email protected]

EPSS history

Timeline

05 DEC 05:31Z
Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter
cvelistv5