CVE-2026-80433 Overview
CVE-2026-80433 is a sensitive data exposure vulnerability affecting the SureFeedback Client Site plugin for WordPress (previously known as ProjectHuddle Child Site) in versions 1.2.12 and earlier. The flaw stems from a missing authorization check [CWE-862], allowing authenticated users with subscriber-level privileges to access sensitive data they should not be able to view. Any low-privileged account on an affected WordPress site can exploit the issue over the network without user interaction.
Critical Impact
Authenticated subscribers can retrieve sensitive information from SureFeedback Client Site installations, breaking confidentiality boundaries between low-privileged users and site administrators.
Affected Products
- SureFeedback Client Site (WordPress plugin) versions <= 1.2.12
- Previously distributed as the ProjectHuddle Child Site plugin
- WordPress sites permitting subscriber-level account registration
Discovery Timeline
- 2026-08-27 - CVE-2026-80433 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80433
Vulnerability Analysis
The vulnerability is a broken access control issue in the SureFeedback Client Site WordPress plugin. The plugin exposes functionality that returns sensitive data without validating whether the requesting user has the appropriate role or capability. Because WordPress subscriber accounts are typically self-registered on many sites, the effective barrier to exploitation is minimal.
A remote attacker who registers or already controls a subscriber account can issue requests to the plugin's endpoints and receive data intended for higher-privileged users. The attack requires no user interaction and can be automated at scale against WordPress sites running the affected plugin.
Root Cause
The root cause is a missing authorization check [CWE-862]. Plugin request handlers verify authentication but do not enforce the capability required to access the underlying data. Any logged-in user, regardless of role, can invoke the affected code paths and read sensitive information.
Attack Vector
Exploitation occurs over the network against the WordPress HTTP interface. The attacker authenticates as a subscriber and sends crafted requests to the plugin's affected endpoints. See the Patchstack Vulnerability Report for coordinated disclosure details.
No public proof-of-concept code is referenced in the advisory. The vulnerability is described in prose only, and no verified exploit code is available at the time of publication.
Detection Methods for CVE-2026-80433
Indicators of Compromise
- Requests to SureFeedback Client Site plugin endpoints originating from accounts with the subscriber role.
- Anomalous data-retrieval patterns from newly registered WordPress accounts shortly after registration.
- Repeated authenticated requests to wp-admin/admin-ajax.php or plugin REST routes tied to the ProjectHuddle Child Site or SureFeedback Client Site plugin.
Detection Strategies
- Inventory WordPress deployments and identify sites running SureFeedback Client Site <= 1.2.12.
- Review web server access logs for authenticated requests to plugin routes correlated with low-privileged sessions.
- Alert on bursts of subscriber account registrations followed by immediate plugin endpoint access.
Monitoring Recommendations
- Forward WordPress access and authentication logs to a centralized analytics platform for correlation.
- Baseline expected request volumes to plugin endpoints and alert on deviations.
- Track new subscriber account creation and monitor first-session behavior for reconnaissance patterns.
How to Mitigate CVE-2026-80433
Immediate Actions Required
- Update SureFeedback Client Site to a version later than 1.2.12 as soon as a fixed release is published by the vendor.
- Disable open user registration or restrict the default role to prevent untrusted subscriber accounts.
- Audit existing subscriber accounts and remove any that are not required.
Patch Information
Refer to the Patchstack Vulnerability Report for the latest patch status and vendor-supplied fix version. Apply the vendor update through the WordPress plugin manager once available.
Workarounds
- Deactivate the SureFeedback Client Site plugin until a patched version is installed.
- Block access to affected plugin endpoints at the web application firewall for non-administrative users.
- Set the WordPress default registration role to a custom role without access to the plugin, or disable users_can_register entirely.
# Disable open registration in wp-config.php or via WP-CLI
wp option update users_can_register 0
# Deactivate the affected plugin until patched
wp plugin deactivate projecthuddle-child-site
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
