The flaw is an access‑control weakness that lets an attacker bypass the plugin’s intended restrictions. By exploiting the missing authorization check, an attacker can view or modify the plugin’s data without the required privileges. This is a classic example of the CWE‑862 vulnerability type.

Installations of the User Feedback plugin from Syed Balkhi that are version 1.10.1 or earlier are vulnerable. Any user running one of these releases may be affected until the plugin is updated to a fixed version.

The vulnerability carries a severity score of 4.3, indicating a moderate risk. Current indicators show that the likelihood of exploitation is low, with reported exploit attempts below 1 percent. It is not included in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread exploitation has been observed to date. The likely attack path involves the plugin’s administrative interfaces or exposed endpoints, where a request that does not meet the required authorization can be sent. The impact is limited to the data and functions of the plugin, but could provide a foothold for further privilege escalation if sensitive information is accessed or if the attacker can manipulate settings that affect the wider WordPress installation.