Surefeedback Client Site
Monthly
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.