CVE-2025-13140 Overview
CVE-2025-13140 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the SurveyJS: Drag & Drop WordPress Form Builder plugin. The flaw exists in all plugin versions up to and including 1.12.20. It stems from missing nonce validation on the SurveyJS_DeleteSurvey AJAX action. Unauthenticated attackers can delete arbitrary surveys by tricking a site administrator into clicking a crafted link or visiting a malicious page. The vulnerability is classified under CWE-352 and requires user interaction to succeed.
Critical Impact
Successful exploitation allows unauthenticated attackers to delete surveys created within WordPress sites running vulnerable versions of the SurveyJS plugin, resulting in loss of data integrity.
Affected Products
- SurveyJS: Drag & Drop WordPress Form Builder plugin versions ≤ 1.12.20
- WordPress sites with the plugin installed and activated
- Administrator accounts authenticated to vulnerable installations
Discovery Timeline
- 2025-12-02 - CVE-2025-13140 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-13140
Vulnerability Analysis
The vulnerability resides in the delete_survey.php AJAX handler within the SurveyJS plugin. The handler processes survey deletion requests submitted through the SurveyJS_DeleteSurvey AJAX action but does not verify a WordPress nonce token before executing the operation. Without nonce validation, the server cannot distinguish between a legitimate request initiated from the WordPress admin interface and a forged request originating from an attacker-controlled page.
An attacker constructs a malicious page or link that triggers the deletion request when visited by an authenticated administrator. The browser automatically attaches the administrator's session cookies, and the request executes with administrative privileges. The result is unauthorized deletion of survey records.
The vulnerability impacts integrity only. Confidentiality and availability of the broader WordPress installation are not directly affected, though loss of survey data can disrupt business operations.
Root Cause
The root cause is the absence of a check_ajax_referer() or wp_verify_nonce() call inside the SurveyJS_DeleteSurvey AJAX handler. WordPress provides nonce mechanisms specifically to prevent CSRF attacks on state-changing operations. The plugin's deletion handler accepts requests based solely on authenticated session state, ignoring request origin validation.
Attack Vector
Exploitation requires an attacker to deliver a crafted link or embed a forged request (such as a hidden form or image tag) on a page visited by an authenticated WordPress administrator. The attacker does not need credentials. When the administrator interacts with the malicious content, the browser submits the deletion request to the target WordPress site, and the vulnerable handler processes it as legitimate.
The vulnerability mechanism is detailed in the WordPress SurveyJS Code Review and the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2025-13140
Indicators of Compromise
- Unexpected deletion of survey entries from the SurveyJS plugin database tables
- HTTP POST requests to admin-ajax.php containing the action=SurveyJS_DeleteSurvey parameter originating from external Referer headers
- Administrator session activity correlated with visits to untrusted external sites
Detection Strategies
- Inspect WordPress access logs for POST requests to wp-admin/admin-ajax.php with the SurveyJS_DeleteSurvey action and validate the Referer header against the site's own domain
- Enable WordPress audit logging plugins to record survey creation and deletion events with user attribution
- Monitor for anomalous administrator behavior patterns, such as deletions occurring outside of normal working hours
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized logging platform for correlation and retention
- Alert on deletion events for SurveyJS records that lack a corresponding administrator-initiated session in the admin dashboard
- Track plugin version inventory across WordPress installations to identify hosts still running versions ≤ 1.12.20
How to Mitigate CVE-2025-13140
Immediate Actions Required
- Update the SurveyJS: Drag & Drop WordPress Form Builder plugin to a version newer than 1.12.20 that includes the fix referenced in the WordPress Changeset Update
- Audit existing survey data and restore any deletions identified through log review
- Educate administrators to avoid clicking unsolicited links while authenticated to the WordPress admin panel
Patch Information
The vendor addressed the vulnerability by adding nonce validation to the delete_survey.php AJAX handler. The fix is documented in WordPress Changeset 3403869. Administrators should upgrade to the patched release through the WordPress plugin manager.
Workarounds
- Deactivate and remove the SurveyJS plugin until the patched version can be deployed
- Deploy a web application firewall rule that blocks requests to admin-ajax.php with action=SurveyJS_DeleteSurvey lacking a valid same-origin Referer header
- Restrict WordPress administrator browsing to dedicated workstations or browser profiles separate from general web use to limit CSRF exposure
# Example WAF rule (ModSecurity syntax) to block cross-origin SurveyJS deletion requests
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
"chain,phase:2,deny,status:403,id:1013140,msg:'CVE-2025-13140 SurveyJS CSRF block'"
SecRule ARGS:action "@streq SurveyJS_DeleteSurvey" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
