Description

Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T10:16:38.780Z",
  "pubdate": "2026-08-27T10:16:38.780Z",
  "executiveSummary": "The SureFeedback plugin for WordPress, specifically in versions 1.2.12 and earlier, contains a critical vulnerability involving the exposure of sensitive subscriber data.\nThis vulnerability is classified as an Improper Access Control issue, allowing unauthorized users to retrieve private information intended for site administrators or authorized personnel.\nThe impact includes the potential leakage of personally identifiable information (PII) or confidential project feedback associated with the subscriber database.\nThe vulnerability is accessible to authenticated users with low-level privileges (such as subscribers), meaning an attacker does not require elevated administrative access to exploit the flaw.\nThe risk implication is significant as it compromises user privacy and data confidentiality, potentially violating data protection regulations.\nNo complex exploitation requirements are noted beyond basic authentication to the WordPress instance, making the barrier to entry for an attacker low.",
  "technicalDetails": "The vulnerability originates from inadequate permission checks within the SureFeedback client-side plugin logic. Specifically, the plugin fails to properly validate the authorization of users requesting access to endpoints that return subscriber-related data.\nIn affected versions (<= 1.2.12), the plugin's API or administrative-facing functions do not enforce strict role-based access control (RBAC). When a request is made to the vulnerable endpoint, the application performs an insufficient check, or completely omits the check, for the 'manage_options' or equivalent high-level capability requirement.\nThe attack flow begins with an attacker authenticating as a standard subscriber on the WordPress site. Once authenticated, the attacker crafts a web request (typically via HTTP GET or POST) targeting the specific SureFeedback endpoint responsible for retrieving subscriber records.\nBecause the server-side code does not verify the requester's identity against the requested resource's ownership or access control list (ACL), the application proceeds to query the database and return the requested data in the HTTP response.\nThe payload returned typically includes structured data such as JSON objects containing subscriber names, email addresses, or other feedback-related metadata stored within the plugin's data structures.\nThis behavior constitutes an Insecure Direct Object Reference (IDOR) or a broken access control vulnerability, where the application exposes internal data structures based on predictable or discoverable input parameters without verifying the session's authorization level.\nThe exposure is network-accessible to any authenticated subscriber, meaning the attack surface is limited only to users with basic login credentials. Post-exploitation, an attacker can programmatically iterate through user IDs or feedback IDs if the endpoint supports parameter manipulation, enabling the mass harvesting of subscriber data across the installation.\nThe root cause is a failure in the plugin’s middleware or controller logic to enforce WordPress capabilities, allowing the plugin to serve administrative-level data to non-privileged entities."
}