CVE-2025-13528: WordPress Feedback Modal Auth Bypass Flaw

CVE-2025-13528 Overview

CVE-2025-13528 affects the Feedback Modal for Website plugin for WordPress in all versions up to and including 1.0.1. The vulnerability stems from a missing capability check on the handle_export function, which allows unauthenticated attackers to export all feedback data through the export_data parameter. Attackers can retrieve the exported data in CSV or JSON format without any authentication. The flaw is classified under CWE-862: Missing Authorization and is exploitable remotely over the network with low attack complexity.

Critical Impact
Unauthenticated remote attackers can exfiltrate all feedback data collected by affected WordPress sites, exposing potentially sensitive user-submitted information.

Affected Products

Feedback Modal for Website plugin for WordPress — all versions through 1.0.1
WordPress sites running the vulnerable plugin with feedback data collected
Deployments exposing the plugin's admin endpoints to unauthenticated network requests

Discovery Timeline

2025-12-05 - CVE-2025-13528 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13528

Vulnerability Analysis

The vulnerability resides in the handle_export function of the Feedback Modal for Website plugin, located in inc/admin/main.php. This function processes export requests but lacks a capability check to verify that the caller is an authorized administrator. Because WordPress plugins commonly register export handlers through admin-post or AJAX hooks, missing capability verification exposes the endpoint to any client that can reach the site.

When an attacker sends a request with the export_data parameter, the function executes the export routine and returns feedback records as CSV or JSON. No nonce validation, session verification, or role check gates the operation. This is a textbook Missing Authorization flaw [CWE-862].

Root Cause

The root cause is the absence of a current_user_can() check (or equivalent capability enforcement) inside handle_export. WordPress plugins must confirm the caller has an appropriate capability, such as manage_options, before performing privileged actions. The Feedback Modal for Website plugin registers the export handler without this gate, treating the endpoint as if it were internally scoped.

Attack Vector

Exploitation is remote and unauthenticated. An attacker identifies a WordPress site running the vulnerable plugin, issues an HTTP request that triggers the export handler with the export_data parameter set to csv or json, and receives the dumped feedback dataset in the response. No user interaction is required, and no privileged account is needed. Feedback submissions may include names, email addresses, comments, and other user-provided content, all of which become disclosed to the attacker. Refer to the Wordfence Vulnerability Intelligence advisory and the WordPress Plugin Source Code for the vulnerable handler location.

Detection Methods for CVE-2025-13528

Indicators of Compromise

HTTP requests to WordPress admin-post or AJAX endpoints containing the export_data parameter from unauthenticated sessions
Responses returning large CSV or JSON payloads to clients without an active administrator session cookie
Access log entries showing the handle_export action triggered by IPs that have never authenticated to /wp-login.php

Detection Strategies

Review WordPress access logs for calls to the plugin's export endpoint originating from external IP addresses
Correlate unauthenticated admin-ajax.php or admin-post.php requests with response sizes indicative of bulk data exfiltration
Deploy Web Application Firewall (WAF) rules that flag export_data parameter usage against the Feedback Modal plugin endpoints

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward events to a centralized log platform for retention and query
Alert on anomalous outbound response sizes tied to plugin-owned URLs, particularly CSV/JSON content types
Monitor for repeat requests to plugin endpoints from single source IPs, which may indicate scripted scraping

How to Mitigate CVE-2025-13528

Immediate Actions Required

Disable or remove the Feedback Modal for Website plugin until a patched version is confirmed installed
Audit stored feedback records to identify sensitive data that may have been exposed and notify affected users where required
Rotate any secrets or tokens that may have been included in feedback submissions

Patch Information

At the time of publication, no fixed version beyond 1.0.1 is referenced in the NVD entry. Site administrators should track the plugin's page on WordPress.org and the Wordfence advisory for a released patch. Once a patched release is available, upgrade immediately and validate that the handle_export function enforces a capability check.

Workarounds

Restrict access to wp-admin/admin-post.php and wp-admin/admin-ajax.php by IP allowlist while the plugin remains installed
Apply WAF rules that block unauthenticated requests carrying the export_data parameter to the plugin's endpoints
Temporarily deactivate the plugin and export/purge stored feedback data if the feature is not business-critical

bash

# Example WAF/nginx rule to block unauthenticated export requests
location ~ ^/wp-admin/admin-(post|ajax)\.php$ {
    if ($arg_export_data) {
        return 403;
    }
}