CVE-2025-13205: SurveyJS WordPress Plugin CSRF Vulnerability

CVE-2025-13205 Overview

CVE-2025-13205 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the SurveyJS: Drag & Drop WordPress Form Builder plugin. This plugin enables users to create, style, and embed multiple forms of any complexity. The vulnerability exists in all versions up to and including 1.12.20 and stems from missing or incorrect nonce validation on the SurveyJS_CloneSurvey AJAX action.

Critical Impact

Unauthenticated attackers can duplicate surveys via forged requests by tricking site administrators into clicking malicious links, potentially leading to unauthorized data manipulation and survey duplication.

Affected Products

• SurveyJS: Drag & Drop WordPress Form Builder plugin versions up to and including 1.12.20
• WordPress sites utilizing vulnerable versions of the SurveyJS plugin

Discovery Timeline

• 2026-01-24 - CVE-2025-13205 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-13205

Vulnerability Analysis

This Cross-Site Request Forgery (CSRF) vulnerability exists because the SurveyJS_CloneSurvey AJAX action handler fails to properly validate nonce tokens. In WordPress, nonce (number used once) validation is a critical security mechanism that ensures requests originate from authenticated users with legitimate intent rather than from forged cross-site requests.

When an authenticated administrator interacts with the vulnerable endpoint, the application does not verify that the request includes a valid security token. This oversight allows attackers to craft malicious web pages or links that, when visited by an authenticated administrator, automatically submit requests to the vulnerable AJAX handler on behalf of that administrator.

Root Cause

The root cause of CVE-2025-13205 lies in the clone_survey.php file within the plugin's AJAX handlers. The SurveyJS_CloneSurvey function processes survey cloning requests without implementing proper WordPress nonce verification using functions like wp_verify_nonce() or check_ajax_referer(). This missing validation allows any request to be processed regardless of its origin, enabling CSRF attacks.

Attack Vector

The attack vector for this vulnerability requires social engineering to be successful. An attacker must convince a logged-in WordPress administrator to visit a malicious webpage or click a crafted link. When the administrator does so, their browser automatically sends an authenticated request to the vulnerable AJAX endpoint, causing surveys to be duplicated without the administrator's knowledge or consent.

The attack chain typically follows this pattern: the attacker identifies a WordPress site running the vulnerable SurveyJS plugin, crafts a malicious HTML page containing a hidden form that targets the SurveyJS_CloneSurvey AJAX action, distributes this page via phishing emails or compromised websites, and when an administrator visits the page while authenticated, their browser submits the forged request with their session cookies.

Detection Methods for CVE-2025-13205

Indicators of Compromise

• Unexpected survey duplications appearing in the WordPress admin panel without administrator action
• Unusual AJAX requests to admin-ajax.php with action parameter SurveyJS_CloneSurvey originating from external referrers
• Multiple survey entries created within short time intervals that weren't initiated by legitimate users
• Web server logs showing POST requests to WordPress AJAX endpoints with suspicious or empty referrer headers

Detection Strategies

• Monitor WordPress AJAX request logs for SurveyJS_CloneSurvey actions with missing or external referrer headers
• Implement web application firewall (WAF) rules to detect and block requests lacking proper nonce tokens
• Configure intrusion detection systems to alert on rapid, repeated survey cloning operations
• Review audit logs for survey creation events that correlate with administrator browsing sessions on external sites

Monitoring Recommendations

• Enable comprehensive WordPress activity logging to track all survey-related administrative actions
• Set up alerts for bulk survey duplication events that exceed normal operational patterns
• Monitor administrator session activity for simultaneous requests from multiple origins
• Implement real-time notification for any changes to survey configurations or content

How to Mitigate CVE-2025-13205

Immediate Actions Required

• Update the SurveyJS: Drag & Drop WordPress Form Builder plugin to a patched version beyond 1.12.20 when available
• Temporarily disable the plugin if a patch is not yet available and survey functionality is not critical
• Educate site administrators about phishing risks and the importance of not clicking untrusted links while logged into WordPress
• Implement additional security layers such as web application firewalls to filter suspicious AJAX requests

Patch Information

Organizations should monitor the official WordPress plugin repository and the Wordfence Vulnerability Advisory for updates regarding patched versions. The vulnerable code can be reviewed at the WordPress Plugin File Reference. Once a patched version is released, update immediately through the WordPress admin dashboard or via WP-CLI.

Workarounds

• Implement server-side request filtering to validate referrer headers for all AJAX requests to the SurveyJS plugin
• Use a security plugin that adds additional CSRF protection layers to WordPress AJAX handlers
• Restrict administrative access to the WordPress backend from trusted IP addresses only
• Consider temporarily removing the survey cloning functionality by deactivating the plugin until a security update is available

# Configuration example - Add to .htaccess to restrict AJAX access by referrer
# This provides defense-in-depth but should not replace proper patching
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^.*admin-ajax\.php.*$ [NC]
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
    RewriteCond %{QUERY_STRING} action=SurveyJS_CloneSurvey [NC]
    RewriteRule .* - [F,L]
</IfModule>