EUVD-2026-66948
GHSA-8v76-8w5q-62c6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEnumerate WordPress site for SureFeedback Client Site plugin
-
DeliveryIdentify exposed unauthenticated REST API or AJAX endpoint
-
ExploitSend crafted HTTP request with no credentials
-
ExecutionBypass absent authorization check
-
ImpactRetrieve subscriber sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions required beyond the plugin being installed and active on a WordPress site running version ≤1.2.12. Exploitation is fully unauthenticated (PR:N) and network-accessible (AV:N) with low attack complexity (AC:L) and no required user interaction (UI:N), consistent with a default plugin activation state. The primary limiting factor is deployment scope - only WordPress sites with this specific plugin active are affected. There is no indication the plugin requires any non-default configuration to be vulnerable; the missing authorization flaw applies to the plugin's baseline installed state. |
| Impact | The CVSS 7.5 score is well-supported by the vector metrics: AV:N confirms network exploitability, AC:L indicates no special conditions, PR:N means zero authentication is required, and C:H reflects meaningful data disclosure. The tags 'Information Disclosure' and 'Authentication Bypass' align consistently with CWE-862 and the PR:N vector. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. KEV status is not listed, and no POC is confirmed - the signal here is elevated CVSS with a straightforward attack pattern, but no evidence of active or imminent exploitation. Real-world priority is moderate: the attack is trivially automatable given the low complexity and no-auth requirements, and WordPress plugin scanners could detect and enumerate vulnerable installations at scale, but the plugin's niche deployment footprint limits aggregate exposure. The confidentiality-only impact (I:N, A:N) further bounds severity for most defenders. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress installation running SureFeedback Client Site ≤1.2.12 using passive enumeration (e.g., plugin path detection or WordPress scanner). The attacker then sends a crafted HTTP request directly to the plugin's exposed REST API or wp-admin/admin-ajax.php endpoint, which returns subscriber-level sensitive data without enforcing authorization checks. No public exploit code is confirmed, but the attack pattern is straightforward enough for manual replication from the vulnerability description alone. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.
RemediationAI
The primary fix is to update the SureFeedback Client Site plugin beyond version 1.2.12 once a patched release is available from Brainstorm Force or the WordPress plugin repository; no specific fixed version was confirmed in available data at time of analysis. Consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/projecthuddle-child-site/vulnerability/wordpress-surefeedback-client-site-plugin-1-2-12-sensitive-data-exposure-vulnerability) for patch availability updates. As a compensating control while awaiting a patch, site administrators can deactivate or uninstall the plugin entirely - this eliminates the exposure but also removes all client feedback functionality. Alternatively, restricting access to WordPress REST API and AJAX endpoints via a WAF or .htaccess rules to authenticated sessions only can reduce the unauthenticated attack surface, though this may break legitimate plugin functionality for anonymous visitors.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SureFeedback Client Site (formerly ProjectHuddle child site component) is a WordPress plugin developed by Brainstorm Force, identified by CPE cpe:2.3:a:brainstorm_force:surefeedback_client_site:*:*:*:*:*:*:*:*. It facilitates client-side feedback collection for WordPress-based project management workflows. CWE-862 (Missing Authorization) is the root cause class - the plugin registers REST API or AJAX action handlers that expose subscriber data without verifying the caller's capability or nonce, allowing any network-accessible request to trigger the data return path. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms the flaw is fully exploitable over the network with low complexity, no privileges, and no user interaction, resulting in high confidentiality impact with no integrity or availability effect.
Know when Surefeedback Client Site gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible unauthenticated endpoint exposes data with no integrity or availability impact; AC:L as no special preconditions beyond plugin activation.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
Executive ViewAI
The SureFeedback Client Site WordPress plugin (version 1.2.12 and earlier) contains an unauthenticated authorization flaw that exposes subscriber-level confidential data to any remote attacker with internet access. Organizations using this plugin face immediate risk of subscriber data compromise, requiring urgent containment to prevent privacy breaches and regulatory violations.
Implement Web Application Firewall rules to restrict unauthenticated access to plugin data endpoints; disable the plugin if operationally feasible; apply network-level IP allowlisting; enable enhanced audit logging to detect exploitation attempts; monitor vendor advisory channels for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB