CVE-2025-12892 Overview
CVE-2025-12892 is a missing authorization vulnerability in the Survey Maker plugin for WordPress. The flaw resides in the deactivate_plugin_option() function, which lacks a capability check across all versions up to and including 5.1.9.4. Unauthenticated attackers can send crafted requests that modify the ays_survey_maker_upgrade_plugin option in the WordPress database. The issue is tracked under CWE-862: Missing Authorization and was addressed in version 5.1.9.5 of the plugin.
Critical Impact
Unauthenticated remote attackers can modify a plugin option value on any vulnerable WordPress site, altering plugin state without credentials.
Affected Products
- Survey Maker plugin for WordPress, all versions through 5.1.9.4
- WordPress sites running the vulnerable plugin regardless of authentication configuration
- Fixed in Survey Maker version 5.1.9.5
Discovery Timeline
- 2025-11-13 - CVE-2025-12892 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12892
Vulnerability Analysis
The Survey Maker plugin exposes an administrative action handler that updates plugin configuration state. The deactivate_plugin_option() function is registered without a corresponding capability check or nonce validation. As a result, any HTTP client can invoke the handler and change the ays_survey_maker_upgrade_plugin option value stored in the wp_options table.
Because the option controls plugin upgrade signaling rather than post content or user data, the confidentiality impact is none. The integrity impact is limited to that specific option, which is why the vulnerability is rated with low integrity impact and no confidentiality or availability effect. The EPSS probability is 0.219%.
Root Cause
The root cause is a missing authorization check inside the plugin's admin class. WordPress plugins that mutate options must gate the operation with current_user_can() and validate a nonce through check_admin_referer() or wp_verify_nonce(). Neither guardrail is present on the affected code path, so unauthenticated requests reach the option update logic. The patch introduced in version 5.1.9.5 adds the capability check, as shown in the WordPress plugin changeset.
Attack Vector
An attacker sends an unauthenticated HTTP request to the WordPress AJAX or admin endpoint that dispatches to deactivate_plugin_option(). The request requires no session, cookie, or user interaction. Successful invocation writes the attacker-influenced value to the ays_survey_maker_upgrade_plugin option. Refer to the Wordfence vulnerability report for additional exploitation context.
Detection Methods for CVE-2025-12892
Indicators of Compromise
- Unexpected changes to the ays_survey_maker_upgrade_plugin value in the wp_options table.
- Access log entries containing admin-ajax.php or plugin admin endpoints referencing Survey Maker actions from unauthenticated sources.
- Repeated POST requests targeting Survey Maker admin action names originating from a single IP or scanner user agent.
Detection Strategies
- Audit the wp_options table for unexpected modifications to Survey Maker option keys and compare against last-known-good values.
- Enable WordPress plugin file integrity monitoring to confirm Survey Maker is upgraded to 5.1.9.5 or later.
- Review web application firewall telemetry for unauthenticated POST requests that invoke Survey Maker admin actions.
Monitoring Recommendations
- Alert on any option update to ays_survey_maker_upgrade_plugin outside of legitimate administrator workflows.
- Correlate WordPress audit logs with edge access logs to identify unauthenticated calls to plugin admin handlers.
- Track version drift across managed WordPress sites and flag any instance still running Survey Maker 5.1.9.4 or earlier.
How to Mitigate CVE-2025-12892
Immediate Actions Required
- Update the Survey Maker plugin to version 5.1.9.5 or later on every affected WordPress site.
- Inspect the ays_survey_maker_upgrade_plugin option value and restore it if it has been modified.
- Restrict access to wp-admin/admin-ajax.php from untrusted networks where feasible.
Patch Information
The vendor released Survey Maker 5.1.9.5, which adds the missing capability check to deactivate_plugin_option(). Review the diff in the WordPress plugin changeset for implementation details. Verify plugin version in the WordPress admin dashboard after updating.
Workarounds
- Deactivate the Survey Maker plugin until the patched version can be deployed.
- Deploy a web application firewall rule blocking unauthenticated requests to Survey Maker admin action names.
- Limit administrative endpoints to allowlisted IP ranges through server or reverse proxy configuration.
# Update Survey Maker via WP-CLI to the patched release
wp plugin update survey-maker --version=5.1.9.5
wp plugin get survey-maker --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
