User Feedback EUVD-2026-20142

Exploitation requires an authenticated WordPress user account with at least subscriber-level access to the target WordPress installation. The User Feedback plugin must be installed and activated on the WordPress site. The vulnerability manifests in any User Feedback plugin version up to and including 1.10.1, regardless of plugin configuration, since the authorization failure is in the plugin's core access control logic.

While the CVSS score of 4.3 and EPSS percentile of 4% indicate modest technical severity and extremely low exploitation probability, the actual risk is context-dependent. The vulnerability requires authenticated access (PR:L in the CVSS vector), meaning an attacker must first obtain a valid WordPress user account, which raises the practical exploitation barrier. The attack vector is network-based with low complexity, so exploitation is straightforward once authentication is achieved. EPSS at 0.02% (4th percentile) suggests this vulnerability is rarely targeted in practice, likely because it requires existing account access and the impact is limited to confidentiality (C:L) with no integrity or availability impact. For organizations with strict user access policies and regular security audits of plugin permissions, this poses minimal risk; however, sites allowing untrusted user registrations or with overly permissive user roles face heightened exposure.

An authenticated WordPress subscriber or contributor user logs in with low-privilege credentials and directly accesses User Feedback administrative functions through their WordPress dashboard or crafted URLs. Due to missing authorization checks, the plugin allows this lower-privileged user to view, export, or potentially modify feedback data they should not have access to, compromising the confidentiality of user feedback meant only for site administrators.