CVE-2025-13139: 
WordPress vulnerability analysis and mitigation

CVE-2025-13139 is a Cross-Site Request Forgery (CSRF) vulnerability in the SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress. It affects all versions up to and including 2.5.2 (initially disclosed as affecting up to 1.12.20, later updated by Wordfence on April 8, 2026 to include up to 2.5.2). The flaw allows unauthenticated attackers to create surveys on behalf of a site administrator via a forged request. It was first published on January 24, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from missing nonce validation on the SurveyJS_AddSurvey AJAX action handler in the plugin. Specifically, the add_survey.php handler (visible at line 12 of the plugin source) does not verify a WordPress nonce before processing the request, meaning any authenticated session context can be abused via a forged cross-origin request. An attacker must craft a malicious page or link that triggers the AJAX action and trick a logged-in site administrator into visiting it — no privileges are required on the attacker's side, but user interaction from an admin is necessary (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to create arbitrary surveys on the affected WordPress site by leveraging an administrator's authenticated session. The integrity impact is limited — no confidential data is exposed and site availability is unaffected — but unauthorized survey creation could be used for phishing, data harvesting from site visitors, or content manipulation. The scope is confined to the affected WordPress installation (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13139. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering an administrator, which raises the practical bar for attackers (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the SurveyJS: Drag & Drop WordPress Form Builder plugin at version ≤ 2.5.2 (e.g., via HTTP response headers, plugin enumeration tools, or public WordPress plugin directories).
2. Craft malicious request: Construct an HTML page or link that submits a forged POST request to the target site's WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to SurveyJS_AddSurvey and desired survey content as the payload.
3. Social engineering: Deliver the malicious link or page to a site administrator via email, comment, or other channel, enticing them to click it while logged into the WordPress admin panel.
4. Survey creation: When the administrator's browser loads the attacker's page, the forged AJAX request is sent with the admin's session cookies, bypassing CSRF protection and creating an attacker-defined survey on the target site (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST requests to /wp-admin/admin-ajax.php with action=SurveyJS_AddSurvey originating from unusual or external referrer URLs.
• Application: Unexpected or unauthorized surveys appearing in the SurveyJS plugin dashboard that were not created by known administrators.
• Network: Referrer headers in admin-ajax.php requests pointing to external or unknown domains, indicating a cross-origin forged request.

Wordfence issued a patch for this vulnerability; the fix is available in the changeset at WordPress Plugin SVN (WordPress Trac Changeset). Site administrators should update the SurveyJS: Drag & Drop WordPress Form Builder plugin to a version beyond 2.5.2 that includes nonce validation on the SurveyJS_AddSurvey AJAX action. As a general workaround, administrators should avoid clicking unsolicited links while logged into the WordPress admin panel and consider using a web application firewall (WAF) such as Wordfence to block suspicious AJAX requests.

The vulnerability was discovered and reported by Wordfence, which published the advisory and coordinated disclosure. Coverage has been limited to automated vulnerability aggregators and security databases, with no notable independent researcher commentary or significant media coverage identified.