Userback WordPress Plugin Missing Authorization Vulnerability Allows Data Exposure

A vulnerability exists in the Userback plugin for WordPress, in all versions through 1.0.15, due to a lack of proper capability checks in the 'userback_get_json' function. This flaw enables authenticated attackers with Subscriber-level access or higher to access and extract sensitive plugin configuration data. The exposed data includes the Userback API access token and content from the site's posts and pages, even those marked as private or in draft status.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive plugin configuration data, including the Userback API access token and private or draft content from the site's posts and pages.