CVE-2025-12891: 
WordPress vulnerability analysis and mitigation

CVE-2025-12891 is a missing authorization vulnerability in the Survey Maker plugin for WordPress that allows unauthenticated attackers to access all survey submissions. The flaw affects all versions of the plugin up to and including 5.1.9.4, and was disclosed on November 13, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization) and stems from the absence of a capability check on the ays_survey_show_results AJAX endpoint in the Survey Maker plugin. Because WordPress AJAX endpoints are accessible over the network without authentication when not properly guarded, any unauthenticated remote attacker can send a crafted HTTP request to this endpoint and retrieve all stored survey submission data. No special privileges, user interaction, or complex conditions are required for exploitation (Wordfence, Red Hat CVE).

Successful exploitation results in unauthorized disclosure of all survey submissions stored by the plugin, which may include personally identifiable information (PII) or other sensitive respondent data submitted through WordPress-hosted surveys. There is no integrity or availability impact — the vulnerability is limited to confidentiality. The scope is confined to the affected WordPress installation, but data exposure could affect all users who submitted survey responses (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low attack complexity and lack of authentication requirements make it straightforward to exploit if targeted, but no threat actor attribution has been identified (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Survey Maker plugin (by ays-pro) in versions ≤ 5.1.9.4 using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Identify the vulnerable endpoint: Locate the WordPress AJAX handler for ays_survey_show_results, typically accessible via https://target-site.com/wp-admin/admin-ajax.php.
3. Craft the request: Send an unauthenticated HTTP POST request to the AJAX endpoint with the action parameter set to ays_survey_show_results (e.g., POST /wp-admin/admin-ajax.php with body action=ays_survey_show_results).
4. Retrieve survey data: The server responds with survey submission data due to the missing capability check, exposing all stored respondent answers without requiring any authentication (Wordfence).

• Network: Unusual or repeated unauthenticated POST requests to /wp-admin/admin-ajax.php with the parameter action=ays_survey_show_results from external IP addresses.
• Logs: WordPress access logs showing POST requests to admin-ajax.php with the ays_survey_show_results action from IPs not associated with legitimate site users or administrators.
• Application: Unexpected spikes in AJAX endpoint traffic targeting the Survey Maker plugin, particularly from automated scanning tools or unfamiliar user agents.

Users should update the Survey Maker plugin to version 5.1.9.5 or later, which addresses the missing capability check on the ays_survey_show_results AJAX endpoint. The fix is available via the WordPress plugin repository. No configuration-based workaround is documented; upgrading is the recommended and only reliable remediation (Wordfence, WordPress Changeset).

Wordfence published a weekly WordPress vulnerability report for the week of November 10–16, 2025, which included CVE-2025-12891 among other disclosed plugin vulnerabilities. The vulnerability received routine coverage from automated vulnerability tracking services (Vulners, CVEFeed, CIRCL) but did not generate significant independent researcher commentary or media coverage, consistent with its medium severity rating (Wordfence Blog).