CVE-2026-5626: WordPress Survey Form Plugin Auth Bypass

CVE-2026-5626 Overview

CVE-2026-5626 is a missing authorization vulnerability in the Survey Form Block plugin for WordPress. The flaw affects all versions up to and including 1.0.1. It stems from a missing capability check on the get_all_data() function in SVBAjax.php. Authenticated attackers with Subscriber-level access or above can export all survey submission data and column metadata. The vulnerability is tracked under [CWE-862] (Missing Authorization). The issue has a network attack vector and requires low privileges without user interaction. Exploitation exposes survey response data collected through the plugin, including any personally identifiable information respondents supplied.

Critical Impact
Any authenticated user with Subscriber-level access or higher can export the complete survey submission dataset stored by the plugin.

Affected Products

WordPress Survey Form Block plugin versions up to and including 1.0.1
Vulnerable component: inc/SVBAjax.phpget_all_data() AJAX handler
Fixed in changeset 3502334 on the plugin trunk

Discovery Timeline

2026-07-29 - CVE-2026-5626 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-5626

Vulnerability Analysis

The Survey Form Block plugin exposes an AJAX endpoint that returns all stored survey submissions and column metadata. The endpoint invokes get_all_data() defined in inc/SVBAjax.php. In vulnerable releases, the handler validates that a request originates from an authenticated session but does not verify that the caller holds an administrative capability such as manage_options. WordPress treats any registered user, including Subscribers, as authenticated. As a result, the endpoint returns survey data to callers who should not have management access to the plugin. The Wordfence advisory documents the missing capability check and confirms remediation in the release following 1.0.1.

Root Cause

The root cause is a missing capability check on a privileged AJAX action. The handler relies on wp_ajax_ registration alone, which authenticates the request but does not authorize it. A current_user_can() call and a nonce validated with check_ajax_referer() are absent from the vulnerable code path. Reviewers can inspect the pre-patch source in the plugin code repository and compare against the fix in the WordPress changeset.

Attack Vector

An attacker registers or compromises a low-privilege WordPress account on a site running the vulnerable plugin. The attacker sends an authenticated POST request to /wp-admin/admin-ajax.php invoking the plugin action that maps to get_all_data(). The server returns the full set of survey responses in the JSON response body. No user interaction, elevated privileges, or additional exploitation primitive is required.

// Exploitation is described in prose above. No verified proof-of-concept
// code is published for CVE-2026-5626. See the referenced Wordfence
// advisory and plugin changeset for technical details.

Detection Methods for CVE-2026-5626

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php from Subscriber-level accounts that invoke the Survey Form Block AJAX action tied to get_all_data().
Unusually large JSON response bodies returned from admin-ajax.php to low-privilege sessions.
New WordPress user registrations followed shortly by admin-ajax.php calls to plugin actions.

Detection Strategies

Review web server and WordPress access logs for admin-ajax.php calls where the action parameter matches the plugin handler and the requesting user role is Subscriber, Contributor, or Author.
Alert on any authenticated AJAX request that returns a response payload larger than a baseline for that user role.
Correlate account creation events with subsequent access to plugin AJAX endpoints in short time windows.

Monitoring Recommendations

Enable WordPress audit logging to capture the requesting user, IP address, action name, and response size for every admin-ajax.php call.
Forward WordPress and web server logs to a centralized analytics platform for retention and cross-site correlation.
Monitor outbound egress from the WordPress host for large exfiltration flows following plugin AJAX activity.

How to Mitigate CVE-2026-5626

Immediate Actions Required

Update the Survey Form Block plugin to the version released after 1.0.1 that includes changeset 3502334.
Restrict open user registration on WordPress sites that do not require it, and audit existing low-privilege accounts.
Rotate credentials for any Subscriber-level or higher accounts that show suspicious admin-ajax.php activity.

Patch Information

The vendor released a fix that adds a capability check to the get_all_data() handler. The remediation is documented in the WordPress changeset and available through the WordPress plugin page. Site owners should apply the update through the WordPress admin dashboard or by pulling the latest package from the plugin repository.

Workarounds

Deactivate and remove the Survey Form Block plugin until the patched version is applied.
Disable open user registration under Settings > General to prevent unauthenticated attackers from obtaining Subscriber accounts.
Restrict access to /wp-admin/admin-ajax.php at the web application firewall for the specific plugin action string until the update is deployed.

bash

# Example WordPress CLI update for the affected plugin
wp plugin update survey-form-block
wp plugin list --name=survey-form-block --fields=name,status,version