The SurveyFunnel – Survey Plugin for WordPress contains sensitive information exposure vulnerabilities in all releases up to and including version 1.1.5. The flaw arises from several REST API endpoints that lack authentication checks, allowing attackers to query and retrieve confidential survey responses. This results in unauthorized disclosure of data that the plugin stores, violating confidentiality safeguards and potentially revealing private respondent information.

The vulnerability applies to installations of the SurveyFunnel – Survey Plugin for WordPress running any version through 1.1.5. Any WordPress site that has this plugin installed and has maintained that or earlier versions is susceptible, regardless of the broader WordPress environment.

The reported CVSS score of 5.3 indicates a medium severity impact. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is unauthenticated and exposed via public REST API endpoints, meaning an attacker can exploit it without credentials simply by accessing the plugin’s URLs. The compromise compromises only confidentiality, with no direct impact on integrity or availability.