PT-2025-43701 · WordPress · User Feedback

CVE-2025-10694 · Publicado 2025-10-25 · Atualizado 2025-10-25

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress versions up to and including 1.8.0

Description The User Feedback plugin for WordPress is susceptible to unauthorized data access. A missing capability check within the maybe load onboarding wizard function allows unauthenticated attackers to access the onboarding wizard page. This access exposes configuration information, including the administrator email address.

Recommendations Update the User Feedback plugin to a version newer than 1.8.0.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-10694

Produtos afetados

User Feedback

Referências · 6

• https://plugins.trac.wordpress.org/changeset/3378233/userfeedback-lite/trunk/includes/admin/class-userfeedback-onboarding-wizard.php?old=3354862&old_path=userfeedback-lite%2Ftrunk%2Fincludes%2Fadmin%2Fclass-userfeedback-onboarding-wizard.php · Nota
• https://twitter.com/CVEnew/status/1981959749718475084 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/9026b417-4b35-4bec-9dc6-6797661dc7a8?source=cve · Nota
• https://t.me/cveNotify/140330 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1982006717828259935 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-10694 · Nota de Segurança