CVE-2025-13194: 
WordPress vulnerability analysis and mitigation

CVE-2025-13194 is a Cross-Site Request Forgery (CSRF) vulnerability in the SurveyJS: Drag & Drop WordPress Form Builder plugin, affecting all versions up to and including 2.5.2. The flaw stems from missing nonce verification on the SurveyJS_RenameSurvey AJAX action, allowing unauthenticated attackers to rename surveys by tricking a site administrator into clicking a malicious link. The vulnerability was first reported by Wordfence on January 24, 2026, and the CVE description was later updated on April 8, 2026, to extend the affected version range from 1.12.20 to 2.5.2. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and resides in the rename_survey.php AJAX handler, which processes the SurveyJS_RenameSurvey action without validating a WordPress nonce. Because no nonce or other CSRF token is checked, any forged HTTP request that triggers this action while an authenticated administrator session is active will be processed by the server. An attacker crafts a malicious page or link that submits a request to the vulnerable endpoint, and if a logged-in administrator visits or clicks it, the survey rename operation executes with the administrator's privileges. The vulnerable code path is publicly visible in the plugin's Trac repository (WordPress Trac).

Successful exploitation allows an unauthenticated attacker to rename any survey managed by the SurveyJS plugin on the affected WordPress site, resulting in a low-severity integrity impact. There is no confidentiality or availability impact — attackers cannot read data or disrupt service through this vector alone. While the direct impact is limited to survey renaming, it could cause operational disruption or confusion for site administrators and end users relying on correctly named survey forms (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13194. The EPSS score is approximately 0.023%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering — specifically, tricking a logged-in WordPress administrator into clicking a crafted link — which raises the practical bar for abuse (Feedly).

1. Reconnaissance: Identify WordPress sites running the SurveyJS: Drag & Drop Form Builder plugin at versions ≤ 2.5.2 using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Construct an HTTP POST request targeting the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to SurveyJS_RenameSurvey and the desired new survey name, without any nonce parameter.
3. Embed in attack vector: Embed the forged request in a malicious web page (e.g., via an auto-submitting HTML form or an <img> tag with a crafted URL) hosted on an attacker-controlled site.
4. Social engineering: Send the link to the malicious page to a site administrator via email, comment, or other channel, enticing them to click it while logged into their WordPress session.
5. Trigger CSRF: When the administrator visits the page, their browser automatically submits the forged request with their active session cookies, causing the server to rename the targeted survey without any nonce validation check (WordPress Trac, Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to /wp-admin/admin-ajax.php with action=SurveyJS_RenameSurvey originating from unusual referrer domains or external IPs.
• Application: Unexplained or unauthorized changes to survey names within the SurveyJS plugin dashboard, particularly if no administrator recalls making such changes.
• Network: HTTP POST requests to the WordPress AJAX endpoint lacking a valid nonce field in the request body, especially from external or unfamiliar referrer URLs.

A patch was released in plugin version 1.12.21 (changeset 3446910 on the WordPress plugin repository), which adds proper nonce verification to the SurveyJS_RenameSurvey AJAX handler. The CVE description was subsequently updated to reflect that versions up to 2.5.2 are affected, suggesting administrators should update to the latest available version beyond 2.5.2. Until patching is possible, administrators should exercise caution with unsolicited links and consider restricting access to the WordPress admin area by IP. Regularly auditing survey names for unauthorized changes can also serve as a compensating control (WordPress Trac Changeset, Wordfence).