CVE-2025-3880 Overview
CVE-2025-3880 affects the Poll, Survey & Quiz Maker Plugin by Opinion Stage for WordPress. The plugin contains a misconfigured capability check on several functions across all versions up to and including 19.9.0. Authenticated users with Contributor-level access or above can change the email address tied to the plugin's account connection and disconnect the plugin from the associated Opinion Stage account. Previously created polls, surveys, and quizzes remain displayed and functional after disconnection. The weakness is classified under CWE-863: Incorrect Authorization.
Critical Impact
Low-privileged WordPress contributors can hijack the plugin's Opinion Stage account link or forcibly disconnect the integration, disrupting site owner control over quiz and survey content.
Affected Products
- Opinion Stage Poll, Survey & Quiz Maker Plugin for WordPress — all versions through 19.9.0
- WordPress sites permitting Contributor-level or higher registration
- Deployments relying on the plugin's Opinion Stage account connection for content synchronization
Discovery Timeline
- 2025-06-17 - CVE-2025-3880 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3880
Vulnerability Analysis
The plugin exposes administrative actions through AJAX handlers that manage the Opinion Stage account connection. These handlers verify only that a request originates from an authenticated WordPress user rather than confirming the caller holds administrative privileges. As a result, any user session with Contributor role or above can invoke the endpoints and alter the account binding.
Exploitation does not yield code execution or data exfiltration. Instead, it lets a contributor swap the linked email address or sever the account link entirely. Because prior content continues rendering after disconnection, site administrators may not immediately detect that new content cannot be published or that the integration has been rerouted to an attacker-controlled account.
Root Cause
The root cause is a missing capability check (CWE-863) in several plugin functions handling the account connection lifecycle. The code likely relies on is_user_logged_in() or nonce validation without a corresponding current_user_can('manage_options') check. Review the relevant handlers in the WordPress Admin Module Code and the plugin bootstrap.
Attack Vector
The attack requires network access to the WordPress site and a valid Contributor-or-above account. An attacker authenticates, then issues a crafted request to the vulnerable AJAX action to change the connected email address or trigger disconnection. No user interaction from an administrator is required. Multi-author sites, publishing platforms, and any deployment allowing open contributor registration face the greatest exposure.
See the Wordfence Vulnerability Analysis for additional technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-3880
Indicators of Compromise
- Unexpected changes to the Opinion Stage connected email address recorded in WordPress options tables.
- Plugin disconnection events logged without a corresponding administrator action.
- POST requests to admin-ajax.php invoking Opinion Stage account-management actions from Contributor-level sessions.
Detection Strategies
- Audit WordPress access logs for admin-ajax.php traffic where the action parameter targets Opinion Stage handlers and the authenticated user lacks administrator privileges.
- Enable a WordPress security or activity plugin to record option changes affecting opinionstage_* keys.
- Correlate contributor account activity with plugin configuration changes over the same session window.
Monitoring Recommendations
- Alert on modifications to plugin configuration options performed by non-administrator roles.
- Monitor for new or repurposed Contributor accounts, particularly those created shortly before configuration changes.
- Track outbound API calls from the plugin to detect redirection to unfamiliar account identifiers.
How to Mitigate CVE-2025-3880
Immediate Actions Required
- Update the Poll, Survey & Quiz Maker Plugin by Opinion Stage to a version later than 19.9.0 that includes the fix from changeset 3310848.
- Verify the Opinion Stage connected email address matches the authorized administrator account.
- Review and prune Contributor-level accounts that are no longer required.
Patch Information
The vendor addressed the missing authorization check in WordPress Changeset #3310848. Administrators should apply the update through the WordPress plugin manager and confirm the installed version reflects the fixed release.
Workarounds
- Temporarily deactivate the plugin on sites that cannot be patched immediately if the integration is not business-critical.
- Restrict user registration and downgrade untrusted Contributor accounts until the update is applied.
- Place the WordPress admin surface behind a web application firewall rule blocking Opinion Stage AJAX actions for non-administrator sessions.
# Verify installed plugin version with WP-CLI
wp plugin get social-polls-by-opinionstage --field=version
# Update to the patched release
wp plugin update social-polls-by-opinionstage
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
