CVE-2025-13139: SurveyJS WordPress Plugin CSRF Vulnerability

CVE-2025-13139 Overview

CVE-2025-13139 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress. The flaw exists in all plugin versions up to and including 2.5.2. The vulnerability stems from missing nonce validation on the SurveyJS_AddSurvey AJAX action. Unauthenticated attackers can create surveys on a target site by tricking a logged-in administrator into clicking a crafted link. The issue is categorized under CWE-352 and requires user interaction to exploit.

Critical Impact
Unauthenticated attackers can forge requests to create arbitrary surveys on WordPress sites running vulnerable versions of the SurveyJS plugin, provided they trick an authenticated administrator into clicking a malicious link.

Affected Products

SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress, versions up to and including 2.5.2
WordPress sites with the vulnerable SurveyJS plugin installed and active
Administrator accounts targeted via social engineering or malicious links

Discovery Timeline

2026-01-24 - CVE-2025-13139 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13139

Vulnerability Analysis

The SurveyJS plugin registers an AJAX action named SurveyJS_AddSurvey to handle survey creation requests. The handler processes incoming POST data and creates a new survey record without verifying a WordPress nonce token. Nonces are WordPress's primary defense against CSRF, ensuring that state-changing requests originate from a legitimate session. Because the handler omits a call to check_ajax_referer() or wp_verify_nonce(), any cross-origin request submitted by an authenticated administrator's browser will be processed as legitimate. Attackers exploit this by hosting a malicious page or sending a crafted link that triggers an automated POST request to the vulnerable endpoint when visited.

Root Cause

The root cause is the absence of nonce validation in the add_survey.php AJAX handler. Reviewing the plugin source at WordPress Plugin Code Review confirms the handler accepts requests based on session authentication alone. WordPress recommends nonce checks on every privileged AJAX action to bind requests to a verified user session. The vendor addressed this in the patch documented at WordPress Changeset Update.

Attack Vector

Exploitation requires an authenticated administrator to visit attacker-controlled content while logged into the WordPress dashboard. The attacker hosts a page containing a hidden HTML form or JavaScript that auto-submits a POST request to the target site's admin-ajax.php endpoint with the action=SurveyJS_AddSurvey parameter. The administrator's browser automatically attaches authentication cookies. The plugin processes the request as authorized and creates the attacker-defined survey. No credentials, prior access, or privileges are required on the attacker side.

The vulnerability mechanism is described in prose because no verified public exploit code is available. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-13139

Indicators of Compromise

Unexpected survey entries appearing in the WordPress admin interface that administrators did not create
POST requests to /wp-admin/admin-ajax.php with action=SurveyJS_AddSurvey originating from external Referer headers
Web server access logs showing survey creation requests immediately following administrator visits to untrusted external sites

Detection Strategies

Monitor WordPress access logs for requests to admin-ajax.php where the Referer header does not match the site's own domain
Alert on creation of new survey database entries outside of expected administrative activity windows
Inspect browser-side telemetry for administrators visiting suspicious URLs while authenticated to WordPress

Monitoring Recommendations

Enable verbose logging on the WordPress admin AJAX endpoint and forward logs to a centralized SIEM for correlation
Track plugin version inventory across WordPress installations to identify hosts running SurveyJS 2.5.2 or earlier
Implement file integrity monitoring on the wp-content/plugins/surveyjs/ directory to detect unauthorized changes

How to Mitigate CVE-2025-13139

Immediate Actions Required

Update the SurveyJS: Drag & Drop WordPress Form Builder plugin to a version newer than 2.5.2 that includes the nonce validation fix
Audit existing surveys for entries that administrators did not author and remove unauthorized records
Instruct administrators to log out of WordPress sessions before browsing external sites and to avoid clicking unsolicited links

Patch Information

The vendor released a fix documented in the WordPress Changeset Update that adds nonce verification to the SurveyJS_AddSurvey AJAX handler. Site administrators should apply the update through the WordPress plugin management interface. Verify the installed version is greater than 2.5.2 after patching.

Workarounds

Deactivate the SurveyJS plugin until the patched version can be applied
Restrict administrator access to the WordPress dashboard using IP allowlisting at the web server or WAF level
Deploy a web application firewall rule that blocks requests to admin-ajax.php with action=SurveyJS_AddSurvey when the Referer header is missing or external

bash

# Example WAF rule to block cross-origin SurveyJS_AddSurvey requests
# ModSecurity rule blocking external referers on the vulnerable AJAX action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1013139,msg:'CVE-2025-13139 CSRF block'"
  SecRule ARGS:action "@streq SurveyJS_AddSurvey" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" "t:none"