CVE-2025-10694 is a missing authorization vulnerability (CWE-862) in the User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds WordPress plugin by smub. The vulnerability exists because the function `maybe_load_onboarding_wizard` does not perform a capability check, allowing unauthenticated users to access the onboarding wizard page. This exposure reveals configuration information, including the administrator email address, potentially aiding further reconnaissance. The issue affects all plugin versions up to 1.8.0. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges required, resulting in limited confidentiality impact without integrity or availability effects.

An unauthenticated attacker can access the onboarding wizard page and view sensitive configuration information such as the administrator email address. This exposure could facilitate targeted phishing or social engineering attacks but does not directly allow system compromise or data modification. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is indicated in the provided data, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the onboarding wizard page through web server configuration or other access controls may reduce exposure.