CVE-2025-13006: SurveyFunnel Information Disclosure Flaw

CVE-2025-13006 Overview

CVE-2025-13006 affects the SurveyFunnel – Survey Plugin for WordPress in all versions up to and including 1.1.5. The plugin exposes several /wp-json/surveyfunnel/v2/ REST API endpoints without proper authorization checks. Unauthenticated attackers can query these endpoints to extract sensitive data collected through survey responses. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The issue is exploitable over the network with no privileges or user interaction required.

Critical Impact
Unauthenticated attackers can retrieve confidential survey response data through unprotected REST API endpoints, exposing personally identifiable information submitted by survey participants.

Affected Products

SurveyFunnel – Survey Plugin for WordPress versions ≤ 1.1.5
WordPress installations with the SurveyFunnel Lite plugin active
The vulnerable component is class-surveyfunnel-lite-rest-api.php

Discovery Timeline

2025-12-05 - CVE-2025-13006 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13006

Vulnerability Analysis

The SurveyFunnel Lite plugin registers multiple REST API routes under the /wp-json/surveyfunnel/v2/ namespace. Several of these route handlers omit a permission_callback that enforces authentication or capability checks. WordPress treats a missing or permissive permission_callback as publicly accessible, so any HTTP client can invoke the endpoints.

The exposed endpoints return survey response data stored by the plugin. This data can include respondent identifiers, free-text answers, and any other fields the survey author defined. Because responses are typically collected under an implicit expectation of confidentiality, unauthorized retrieval constitutes a sensitive information disclosure.

The vulnerability class (CWE-200) is documented in the Wordfence Vulnerability Report. The current EPSS probability is 0.256%.

Root Cause

The root cause is missing authorization on REST API route registrations in class-surveyfunnel-lite-rest-api.php. The developer registered endpoints without a restrictive permission_callback, allowing anonymous requests to reach handlers that read survey submission records. Refer to the WordPress Plugin Source Code and the upstream GitHub Source Code Repository for the affected registrations.

Attack Vector

An attacker sends unauthenticated HTTP GET requests to the affected endpoints under /wp-json/surveyfunnel/v2/ on a target WordPress site. The server responds with JSON payloads containing survey response data. No user interaction, credentials, or elevated privileges are required. Exploitation is fully remote and does not modify data, only reads it.

Detection Methods for CVE-2025-13006

Indicators of Compromise

Anonymous HTTP requests to any path matching /wp-json/surveyfunnel/v2/* in web server access logs
Repeated 200 OK responses to /wp-json/surveyfunnel/v2/ requests with unusually large JSON response bodies
Requests to the WordPress REST API from unfamiliar IP addresses or automated scanner user-agents targeting the SurveyFunnel namespace

Detection Strategies

Grep web access logs for the string surveyfunnel/v2 and flag entries lacking an authenticated session cookie or nonce
Run an authenticated plugin inventory scan to identify SurveyFunnel Lite installations at version 1.1.5 or below
Use WordPress security scanners such as Wordfence or WPScan, which include signatures for this advisory

Monitoring Recommendations

Alert on spikes in /wp-json/surveyfunnel/ traffic volume compared to a rolling baseline
Monitor egress data volumes from WordPress hosts to detect bulk survey data extraction
Track WordPress plugin version drift and flag hosts running SurveyFunnel Lite below the patched release

How to Mitigate CVE-2025-13006

Immediate Actions Required

Update SurveyFunnel Lite to a version above 1.1.5 once the vendor publishes a patched release
If no fixed version is available, deactivate and remove the plugin from all WordPress sites
Review survey response records for evidence of unauthorized access and notify affected respondents if data was exposed

Patch Information

At the time of the NVD publication on 2025-12-05, all versions up to and including 1.1.5 are vulnerable. Administrators should consult the Wordfence Vulnerability Report and the plugin's WordPress.org listing for the latest fixed release. The fix requires adding a restrictive permission_callback to each affected register_rest_route call in class-surveyfunnel-lite-rest-api.php.

Workarounds

Block anonymous access to /wp-json/surveyfunnel/v2/* at the web application firewall or reverse proxy layer
Restrict the WordPress REST API to authenticated users using a hardening plugin or custom rest_authentication_errors filter
Purge existing survey response data from the plugin if it is no longer needed for business purposes

bash

# Example nginx location block to deny anonymous access to the vulnerable endpoints
location ~ ^/wp-json/surveyfunnel/v2/ {
    deny all;
    return 403;
}