PT-2025-43701 · WordPress · User Feedback

Published 2025-10-25 · Updated 2025-10-25 · CVE-2025-10694

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress versions up to and including 1.8.0

Description The User Feedback plugin for WordPress is susceptible to unauthorized data access. A missing capability check within the maybe load onboarding wizard function allows unauthenticated attackers to access the onboarding wizard page. This access exposes configuration information, including the administrator email address.

Recommendations Update the User Feedback plugin to a version newer than 1.8.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-10694

Affected Products

User Feedback

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10694 · Security Note
• https://plugins.trac.wordpress.org/changeset/3378233/userfeedback-lite/trunk/includes/admin/class-userfeedback-onboarding-wizard.php?old=3354862&old_path=userfeedback-lite%2Ftrunk%2Fincludes%2Fadmin%2Fclass-userfeedback-onboarding-wizard.php · Note
• https://twitter.com/CVEnew/status/1981959749718475084 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9026b417-4b35-4bec-9dc6-6797661dc7a8?source=cve · Note
• https://t.me/cveNotify/140330 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1982006717828259935 · Twitter Post