CVE-2025-32251: Jetpack Feedback Exporter Info Disclosure

CVE-2025-32251 Overview

CVE-2025-32251 is a sensitive information disclosure vulnerability in the Jetpack Feedback Exporter plugin for WordPress, developed by J. Tyler Wiest. The flaw allows unauthenticated attackers to retrieve embedded sensitive data from affected sites over the network. The issue is classified under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. All versions of the jetpack-feedback-exporter plugin up to and including 1.23 are affected.

Critical Impact
Unauthenticated network attackers can retrieve embedded sensitive data from WordPress sites running vulnerable versions of the Jetpack Feedback Exporter plugin, potentially exposing form submissions and other confidential feedback content.

Affected Products

Jetpack Feedback Exporter plugin for WordPress
Versions from n/a through <= 1.23
WordPress installations using the jetpack-feedback-exporter plugin

Discovery Timeline

2025-04-04 - CVE-2025-32251 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32251

Vulnerability Analysis

The Jetpack Feedback Exporter plugin exposes sensitive system information to unauthorized parties. The plugin fails to enforce proper access controls on data intended for privileged users. An unauthenticated attacker can reach the exposure surface over the network without user interaction. The exposed information can include feedback form submissions and other embedded data managed by the plugin.

According to the Patchstack advisory, the exposure occurs through functionality that returns sensitive data without adequate authentication or authorization checks. The vulnerability affects data confidentiality but does not directly compromise integrity or availability of the WordPress installation.

Root Cause

The root cause is improper protection of sensitive data as described by [CWE-497]. The plugin exposes information that should remain restricted to authorized administrators. Missing or insufficient authorization checks in the request handling logic allow anonymous requests to retrieve protected content.

Attack Vector

Exploitation requires only network access to a vulnerable WordPress site. No credentials or user interaction are needed. An attacker sends crafted HTTP requests to the plugin's exposed endpoints and receives back sensitive feedback data or system information. Automated scanners can identify affected sites at scale by fingerprinting the plugin version.

No verified public proof-of-concept code is available. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-32251

Indicators of Compromise

Anonymous HTTP GET or POST requests targeting jetpack-feedback-exporter plugin paths under /wp-content/plugins/jetpack-feedback-exporter/
Unexpected outbound responses containing feedback form data returned to unauthenticated clients
Access log entries showing repeated requests to plugin export endpoints from a single IP or user agent

Detection Strategies

Inventory WordPress installations and identify sites running jetpack-feedback-exporter version 1.23 or earlier
Review web server access logs for requests to plugin URLs originating from unauthenticated sessions
Deploy web application firewall (WAF) rules that flag anonymous access to WordPress plugin export functionality

Monitoring Recommendations

Alert on HTTP responses from plugin endpoints that exceed baseline size, indicating potential data export
Track user agent strings and source IPs querying WordPress plugin directories for scanning behavior
Monitor plugin version telemetry across managed WordPress fleets to identify unpatched instances

How to Mitigate CVE-2025-32251

Immediate Actions Required

Identify all WordPress sites running the Jetpack Feedback Exporter plugin and check installed versions
Update the jetpack-feedback-exporter plugin to a version later than 1.23 once a fix is published by the maintainer
If no fixed version is available, deactivate and remove the plugin until a patch is released

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status. The advisory covers versions up to and including 1.23. Administrators should verify the maintainer's plugin repository for a release addressing the sensitive data exposure.

Workarounds

Deactivate the Jetpack Feedback Exporter plugin from the WordPress administration console until a patched release is available
Restrict access to /wp-content/plugins/jetpack-feedback-exporter/ at the web server or WAF layer using IP allowlisting
Purge or archive historical feedback submissions to reduce the volume of sensitive data exposed if exploitation occurs

bash

# Example nginx configuration to block anonymous access to the plugin path
location ^~ /wp-content/plugins/jetpack-feedback-exporter/ {
    allow 10.0.0.0/8;
    deny all;
}