The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds WordPress plugin contains a missing capability check in the maybe_load_onboarding_wizard function. This flaw allows unauthenticated attackers to access the onboarding wizard page, where configuration data such as the administrator email can be viewed. The vulnerability is a classic example of missing authorization (CWE‑862) and results in plain information disclosure without enabling further privileges or compromising the system.

All installations of the User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin with versions 1.8.0 or earlier are affected. The flaw exists in the private onboarding wizard component accessed through WordPress admin URLs.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending a simple HTTP request to the exposed onboarding wizard page, which is publicly accessible without authentication. Because no authentication or additional permissions are required, the attack can be performed from any remote location, though the impact is limited to the disclosure of configuration data.