Unauthorized Data Access in User Feedback Plugin for WordPress
CVE-2025-10694
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 October 2025
What is CVE-2025-10694?
The User Feedback plugin for WordPress is affected by a security flaw that allows unauthorized users to access sensitive configuration information. This vulnerability arises from a lack of capability checks on the maybe_load_onboarding_wizard function in all versions up to and including 1.8.0. As a result, unauthenticated attackers can directly navigate to the onboarding wizard page, potentially exposing details such as the administrator's email address, which heightens the risk of further attacks.
Affected Version(s)
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds * <= 1.8.0