CVE-2025-10694: WordPress User Feedback Auth Bypass Flaw

CVE-2025-10694 Overview

CVE-2025-10694 is a missing authorization vulnerability in the User Feedback plugin for WordPress, which provides interactive feedback forms, user surveys, and polls. The flaw resides in the maybe_load_onboarding_wizard function, which lacks a capability check across all plugin versions up to and including 1.8.0. Unauthenticated attackers can reach the onboarding wizard page and read configuration information, including the administrator email address. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated remote attackers can view sensitive plugin configuration data, including the administrator email address, enabling targeted phishing and account takeover reconnaissance.

Affected Products

WordPress plugin: User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds (userfeedback-lite)
All versions up to and including 1.8.0
WordPress sites with the plugin active and reachable over the network

Discovery Timeline

2025-10-25 - CVE-2025-10694 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10694

Vulnerability Analysis

The vulnerability exists in the maybe_load_onboarding_wizard function inside class-userfeedback-onboarding-wizard.php. The function is registered as an admin handler but does not verify the caller's WordPress capabilities before rendering the onboarding wizard interface. As a result, any unauthenticated visitor able to request the wizard endpoint receives configuration data intended for site administrators.

The exposed onboarding page includes the administrator email address stored in the site's WordPress options. Attackers can use this data to craft targeted phishing campaigns, correlate administrator identities across breach data sets, or seed password-reset workflows against known accounts.

The attack requires no privileges and no user interaction, and it does not modify data or affect availability. See the Wordfence Vulnerability Analysis for additional detail.

Root Cause

The root cause is a missing current_user_can() capability check and missing nonce verification on the onboarding wizard loader. WordPress plugin authors are expected to gate administrative endpoints with manage_options or an equivalent capability. Without this check, the handler executes for any HTTP client that reaches the corresponding admin URL.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the WordPress admin endpoint that triggers the onboarding wizard loader. The server returns the wizard page contents, including the administrator email address and related plugin configuration. The exact request pattern and fix are documented in the WordPress Change Log Update.

No public proof-of-concept exploit code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.238% (percentile 15.05) as of 2026-07-28.

Detection Methods for CVE-2025-10694

Indicators of Compromise

Unauthenticated HTTP GET requests to WordPress admin URLs that reference the userfeedback-lite onboarding wizard handler
Web server logs showing 200 responses to /wp-admin/ requests containing userfeedback and onboarding parameters from anonymous sessions
Spikes in phishing emails targeting the WordPress administrator email address shortly after external scans

Detection Strategies

Inspect access logs for requests to admin endpoints that succeed without an authenticated wordpress_logged_in cookie
Deploy web application firewall (WAF) rules that block unauthenticated access to plugin admin handlers, especially onboarding and setup wizards
Correlate scanner user-agents and repeated requests against the userfeedback-lite endpoint to identify enumeration activity

Monitoring Recommendations

Track the installed version of the User Feedback plugin across all WordPress sites and alert on versions at or below 1.8.0
Monitor outbound email volume to the administrator address for phishing indicators following any known exposure
Ingest WordPress access logs into a SIEM to baseline normal admin-endpoint traffic and surface anomalous unauthenticated hits

How to Mitigate CVE-2025-10694

Immediate Actions Required

Update the User Feedback plugin to the version released after 1.8.0 that includes the capability check fix
Audit WordPress access logs for prior unauthenticated requests to the onboarding wizard endpoint
Rotate or verify the administrator email address if evidence of enumeration is found, and prime staff for targeted phishing

Patch Information

The vendor fixed the issue by adding a capability check to the maybe_load_onboarding_wizard function. The exact code change is available in the WordPress plugin trac changeset 3378233. Site administrators should update through the WordPress plugin dashboard or by replacing the plugin files on disk.

Workarounds

Deactivate and remove the User Feedback plugin until the patched version can be installed
Restrict access to /wp-admin/ at the web server or WAF layer using IP allowlisting for administrators
Add a temporary server-side rewrite rule that blocks requests referencing the onboarding wizard handler for unauthenticated sessions

bash

# Example nginx rule to block unauthenticated access to the onboarding wizard
location ~* /wp-admin/.*userfeedback.*onboarding {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}