CVE-2025-12891: Survey Maker WordPress Plugin Vulnerability

CVE-2025-12891 Overview

CVE-2025-12891 affects the Survey Maker plugin for WordPress. The plugin exposes an AJAX endpoint, ays_survey_show_results, that lacks a capability check. Unauthenticated attackers can invoke the endpoint and retrieve all survey submissions stored by the plugin. The flaw is classified under CWE-862: Missing Authorization and impacts every release up to and including version 5.1.9.4. The issue is remotely exploitable over the network without user interaction or privileges, but its impact is limited to confidentiality of submission data.

Critical Impact
Unauthenticated attackers can read every survey submission stored by vulnerable Survey Maker installations, exposing potentially sensitive respondent data.

Affected Products

Survey Maker plugin for WordPress, all versions up to and including 5.1.9.4
WordPress sites running the vulnerable plugin with the ays_survey_show_results handler registered
Fixed in Survey Maker 5.1.9.5

Discovery Timeline

2025-11-13 - CVE-2025-12891 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12891

Vulnerability Analysis

The Survey Maker plugin registers the AJAX action ays_survey_show_results inside its admin controller class-survey-maker-admin.php. WordPress exposes AJAX callbacks through admin-ajax.php, and any handler registered with the wp_ajax_nopriv_ prefix is reachable by unauthenticated users. In vulnerable releases, the handler returns survey response data without verifying that the caller has an administrative capability such as manage_options or edit_posts.

An attacker sends a crafted POST request to admin-ajax.php with the action parameter set to ays_survey_show_results and a target survey identifier. The plugin returns the stored responses in JSON format. Because surveys frequently collect email addresses, contact details, employer information, or opinion data, the exposure translates directly into a data confidentiality breach for the site operator and respondents.

Root Cause

The root cause is a missing authorization check [CWE-862]. The endpoint validates neither the caller's WordPress capability nor a nonce tied to an administrative screen. The fix committed in changeset 3394078 for tag 5.1.9.5 adds capability enforcement before the results are returned. Refer to the WordPress plugin changeset for the source-level diff.

Attack Vector

Exploitation requires only network access to the target site. The attacker issues an HTTP POST to /wp-admin/admin-ajax.php with action=ays_survey_show_results and iterates over survey IDs to enumerate submissions. No credentials, cookies, or user interaction are required. See the Wordfence vulnerability report for additional detail.

Detection Methods for CVE-2025-12891

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php containing action=ays_survey_show_results
Repeated requests iterating numeric survey_id values from a single client IP or user agent
Large JSON responses from admin-ajax.php returned to unauthenticated sessions

Detection Strategies

Inspect web server access logs for admin-ajax.php requests carrying the ays_survey_show_results action from clients without an authenticated wordpress_logged_in_* cookie.
Alert on enumeration patterns where a single source requests multiple survey identifiers within a short time window.
Correlate WordPress plugin inventory data with vulnerable versions of Survey Maker at or below 5.1.9.4.

Monitoring Recommendations

Enable WordPress plugin auditing to track version drift across managed sites.
Forward web server and WAF logs to a centralized store for retention and rule-based detection.
Baseline normal request volumes to admin-ajax.php to make abusive enumeration stand out.

How to Mitigate CVE-2025-12891

Immediate Actions Required

Update the Survey Maker plugin to version 5.1.9.5 or later on every WordPress instance.
Audit historical admin-ajax.php logs for prior calls to ays_survey_show_results from unauthenticated clients.
Rotate or notify respondents if survey data containing personally identifiable information may have been exposed.

Patch Information

The vendor released Survey Maker 5.1.9.5 with a capability check on the affected handler. The corresponding source change is documented in changeset 3394078 on plugins.trac.wordpress.org. Applying the update is the definitive fix.

Workarounds

Deactivate the Survey Maker plugin until it can be updated on sites that cannot patch immediately.
Add a web application firewall rule that blocks unauthenticated requests to admin-ajax.php with action=ays_survey_show_results.
Restrict access to /wp-admin/ at the reverse proxy for source IP ranges that do not require administrative access.

bash

# Example ModSecurity rule blocking anonymous access to the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1029121,\
  msg:'Block unauthenticated ays_survey_show_results (CVE-2025-12891)'"
  SecRule ARGS:action "@streq ays_survey_show_results" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"