The Feedback Modal for Website WordPress plugin suffers from a missing capability check (CWE-862) in its 'handle_export' function. This flaw permits unauthenticated remote attackers to export all stored feedback data by leveraging the 'export_data' parameter, bypassing any authorization controls. The vulnerability affects all versions up to and including 1.0.1. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or vendor advisory is currently available.

An attacker can remotely and without authentication export all feedback data collected by the plugin in CSV or JSON format. This leads to unauthorized disclosure of potentially sensitive user feedback information. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's export functionality by limiting public access to the affected endpoints or disabling the export feature if possible.