CVE-2026-80433 in SureFeedback Client Site Plugin
Summary
by MITRE • 08/27/2026
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified as CVE-2024-surefeedback-exposure represents a critical information disclosure flaw within the SureFeedback WordPress plugin, specifically affecting versions up to and including 1.2.12. This security defect stems from an improper implementation of access controls on server-side endpoints that handle customer feedback data. In a properly secured application architecture, sensitive personal identifiable information such as subscriber names, email addresses, phone numbers, and potentially payment details must be strictly gated behind authentication checks or role-based permissions. However, in the affected versions of SureFeedback, certain API endpoints or database query handlers fail to verify whether the requesting user possesses the necessary administrative privileges before returning data. This oversight allows any authenticated user with even minimal capabilities, such as a subscriber-level account, to interact directly with these internal functions and retrieve sensitive records belonging to other users.
From a technical perspective, this flaw aligns closely with CWE-284 Improper Access Control and CWE-359 Exposure of Private Personal Information to an Unauthorized Actor. The root cause lies in the plugin's failure to enforce strict validation on incoming requests targeting feedback submission or retrieval mechanisms. By bypassing standard WordPress capability checks, attackers can exploit these endpoints using simple HTTP GET or POST requests crafted with specific parameters that reference target subscriber IDs or email addresses. This type of vulnerability is particularly dangerous because it does not require complex exploitation techniques; instead, it relies on the predictable structure of database queries and the lack of server-side authorization logic to expose large volumes of data in a structured format such as JSON or XML.
The operational impact of this vulnerability is severe due to the nature of the exposed data. Subscriber sensitive data exposure can lead to significant privacy violations under regulations like GDPR, CCPA, and other global data protection laws. Attackers who exploit this flaw can harvest contact information for spamming, phishing campaigns, or credential stuffing attacks against targeted individuals. Furthermore, the aggregation of such data facilitates social engineering efforts where attackers use personal details to gain trust or bypass security questions on other platforms. For businesses relying on SureFeedback, this breach erodes customer trust and exposes them to potential legal liabilities and reputational damage resulting from non-compliance with data privacy standards.
In terms of threat actor behavior, this vulnerability maps directly to the MITRE ATT&CK technique T1005 Data from Local System which involves collecting information stored on local drives or databases for later exfiltration. It also relates to T1539 Steal Web Session Cookie if session tokens are inadvertently exposed alongside user data, although the primary vector here is direct database query manipulation rather than session hijacking. The ease of exploitation means that automated scanners and opportunistic attackers frequently target such misconfigurations in widely used plugins like SureFeedback, making prompt remediation essential to prevent large-scale data breaches across multiple websites running vulnerable instances.
To mitigate this risk, administrators must immediately upgrade the SureFeedback plugin to version 1.2.13 or later where these access control checks have been corrected and validated by developers. Until an update is applied, temporary mitigations include restricting file permissions on WordPress directories to prevent unauthorized script execution and implementing Web Application Firewall rules that monitor for anomalous patterns in API requests targeting feedback endpoints. Additionally, organizations should review their logging mechanisms to detect any past exploitation attempts characterized by repeated queries from low-privilege accounts accessing sensitive user fields. Regular security audits and adherence to secure coding practices that prioritize least privilege principles are crucial for preventing similar access control failures in future software updates.