CVE-2025-13528: 
WordPress vulnerability analysis and mitigation

CVE-2025-13528 is a Missing Authorization vulnerability in the "Feedback Modal for Website" WordPress plugin that allows unauthenticated attackers to export all feedback data collected by the plugin. The flaw affects all versions up to and including 1.0.1, and was published on December 5, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium), reflecting its network-accessible, low-complexity, no-authentication-required nature with a confidentiality-only impact (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the handle_export function within the plugin's admin handler (inc/admin/main.php, line 1011). Because no authentication or authorization check is enforced before processing the export_data parameter, any unauthenticated HTTP request can trigger the export routine. An attacker simply needs to send a crafted request with the appropriate export_data parameter value to receive all stored feedback records in CSV or JSON format (Wordfence, WordPress Trac).

Successful exploitation results in unauthorized disclosure of all feedback data stored by the plugin, which may include user-submitted messages, contact details, email addresses, or other personally identifiable information (PII) depending on how the site uses the plugin. There is no integrity or availability impact, but the confidentiality breach could expose sensitive visitor data and potentially violate privacy regulations such as GDPR. The scope is limited to the plugin's data store and does not directly enable lateral movement or code execution (Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-13528. The EPSS score is approximately 0.039% (0.000390), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence).

1. Reconnaissance: Identify WordPress sites running the "Feedback Modal for Website" plugin (version ≤ 1.0.1) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files at /wp-content/plugins/feedback-modal-for-website/readme.txt.
2. Identify the vulnerable endpoint: Locate the WordPress admin-ajax or admin POST endpoint that invokes the handle_export function — typically via wp-admin/admin-ajax.php or a registered admin action.
3. Craft the malicious request: Send an unauthenticated HTTP POST or GET request with the export_data parameter set to the appropriate value (e.g., csv or json) to trigger the export function without any authentication cookies or nonce.
4. Receive exported data: The server responds with a file download containing all stored feedback records in the requested format (CSV or JSON), exposing user-submitted data to the attacker (Wordfence, WordPress Trac).

• Network: Unauthenticated HTTP requests to WordPress admin endpoints (e.g., wp-admin/admin-ajax.php or admin POST URLs) containing the export_data parameter with values such as csv or json, originating from unexpected or external IP addresses.
• Logs: Web server access logs showing requests to admin-ajax or admin endpoints with export_data parameter from unauthenticated sessions (no valid WordPress auth cookies); unusual spikes in data download volume from admin endpoints.
• File System: No direct file system artifacts expected, as the export is served as a download response rather than written to disk on the server.

Site administrators should update the "Feedback Modal for Website" plugin to a version beyond 1.0.1 that includes a proper capability check on the handle_export function. If no patched version is yet available from the plugin author (nedwp), the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, web application firewalls (WAFs) can be configured to block unauthenticated requests containing the export_data parameter targeting WordPress admin endpoints (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on December 5, 2025. No significant broader media coverage, notable researcher commentary, or substantial social media discussion has been identified beyond standard CVE aggregator postings (Wordfence).