CVE-2025-13205: 
WordPress vulnerability analysis and mitigation

CVE-2025-13205 is a Cross-Site Request Forgery (CSRF) vulnerability in the SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress. It affects all versions up to and including 2.5.2 (initially disclosed as up to 1.12.20, later updated on April 8, 2026 to reflect 2.5.2). The flaw allows unauthenticated attackers to duplicate surveys by tricking a site administrator into clicking a malicious link, triggering the SurveyJS_CloneSurvey AJAX action without proper nonce validation. It was published on January 24, 2026, with a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from missing or incorrect nonce validation in the SurveyJS_CloneSurvey AJAX action handler, as visible in the plugin source at ajax_handlers/clone_survey.php (WordPress Plugin Trac). Because WordPress AJAX actions require nonce verification to confirm the legitimacy of requests, the absence of this check allows any forged HTTP request to invoke the clone action on behalf of an authenticated administrator. Exploitation requires social engineering — the attacker must trick a logged-in site administrator into visiting a malicious page or clicking a crafted link that silently submits the forged request (Wordfence).

Successful exploitation allows an unauthenticated attacker to duplicate existing surveys on the affected WordPress site, resulting in unauthorized modification of site content (low integrity impact). There is no confidentiality or availability impact, as the attack is limited to cloning survey data rather than reading sensitive information or disrupting service. While the direct impact is limited, unauthorized survey duplication could be used to create confusion, spam, or serve as a stepping stone for further content manipulation if combined with other vulnerabilities (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (an administrator must be tricked into clicking a malicious link), which further limits practical exploitability.

1. Reconnaissance: Identify WordPress sites running the SurveyJS: Drag & Drop Form Builder plugin at versions ≤ 2.5.2 using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Construct a forged HTTP POST request targeting the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to SurveyJS_CloneSurvey and a valid survey ID to clone.
3. Embed in attack page: Host a malicious web page containing an auto-submitting HTML form or JavaScript that sends the forged request to the target WordPress site's AJAX endpoint.
4. Social engineering: Trick a logged-in site administrator into visiting the malicious page (e.g., via phishing email or malicious link), causing their browser to automatically submit the forged request with their authenticated session cookies.
5. Survey duplication: The server processes the request without nonce validation, duplicating the targeted survey on the victim's WordPress site (Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to /wp-admin/admin-ajax.php with action=SurveyJS_CloneSurvey originating from unusual referrer URLs or external domains.
• Application: Unexpected duplicate surveys appearing in the SurveyJS plugin dashboard without corresponding administrator activity.
• Network: HTTP POST requests to the WordPress AJAX endpoint from IP addresses not associated with known administrators, particularly with mismatched or absent nonce values in the request body.

Users should update the SurveyJS: Drag & Drop WordPress Form Builder plugin to a version beyond 2.5.2 that includes proper nonce validation on the SurveyJS_CloneSurvey AJAX action (Wordfence). As a temporary workaround, administrators can disable the plugin until a patched version is available, or restrict access to the WordPress admin area using IP allowlisting. Administrators should also exercise caution when clicking links from untrusted sources while logged into the WordPress dashboard.

The vulnerability was discovered and reported by Wordfence, which serves as the CNA for this CVE. Coverage has been limited to automated vulnerability aggregation platforms and security databases, with no notable researcher commentary or significant media coverage identified beyond standard vulnerability disclosure channels (Wordfence).