平台
wordpress
组件
surveyjs
修复版本
1.10.0
2.5.4
CVE-2025-13205 describes a Cross-Site Request Forgery (CSRF) vulnerability present in the SurveyJS: Drag & Drop WordPress Form Builder plugin. This flaw allows unauthenticated attackers to potentially duplicate surveys by exploiting a lack of proper nonce validation within the SurveyJS_CloneSurvey AJAX action. The vulnerability impacts versions 1.0.0 through 2.5.2, and a fix is available in version 2.5.3.
The primary impact of this CSRF vulnerability lies in the ability of an attacker to duplicate surveys without authentication. By crafting a malicious link and enticing a site administrator to click it, an attacker can trigger the SurveyJS_CloneSurvey action, effectively creating a copy of a survey. While seemingly minor, this could be leveraged for various malicious purposes, such as creating duplicate forms to collect sensitive data, disrupting legitimate survey operations, or potentially injecting malicious content into the duplicated forms. The blast radius is limited to the WordPress site using the vulnerable plugin and its administrators.
This vulnerability was publicly disclosed on 2026-01-24. No public proof-of-concept (POC) code has been identified at the time of writing. The vulnerability is not currently listed on the CISA KEV catalog. Given the relatively straightforward nature of CSRF exploitation and the plugin's popularity, it's prudent to assume potential for exploitation, especially if the plugin is widely deployed with default configurations.
WordPress sites utilizing the SurveyJS: Drag & Drop Form Builder plugin, particularly those with site administrators who are not adequately trained in security best practices or who frequently click on links from untrusted sources, are at increased risk. Shared hosting environments where multiple users share the same server and resources are also more vulnerable.
• wordpress / composer / npm:
grep -r 'SurveyJS_CloneSurvey' /var/www/html/wp-content/plugins/survey-js-drag-and-drop-form-builder/• generic web:
curl -I https://example.com/wp-admin/admin-ajax.php?action=SurveyJS_CloneSurvey # Check for lack of CSRF tokendisclosure
漏洞利用状态
EPSS
0.01% (0% 百分位)
CISA SSVC
CVSS 向量
The recommended mitigation is to immediately upgrade the SurveyJS: Drag & Drop WordPress Form Builder plugin to version 2.5.3 or later. If upgrading is not immediately feasible, implement temporary workarounds. These include implementing Web Application Firewall (WAF) rules to filter requests to the SurveyJS_CloneSurvey action, requiring stricter user authentication and authorization controls, and educating administrators about the risks of clicking on untrusted links. Regularly review WordPress plugin security best practices and ensure all plugins are kept up-to-date.
更新到 2.5.3 版本，或更新的补丁版本
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-13205 is a Cross-Site Request Forgery (CSRF) vulnerability affecting versions 1.0.0–2.5.2 of the SurveyJS Drag & Drop Form Builder WordPress plugin, allowing unauthorized survey duplication.
If you are using SurveyJS Drag & Drop Form Builder version 1.0.0 through 2.5.2 on your WordPress site, you are potentially affected by this vulnerability.
Upgrade the SurveyJS Drag & Drop Form Builder plugin to version 2.5.3 or later to resolve the vulnerability. Implement WAF rules as a temporary mitigation.
While no active exploitation has been confirmed, the vulnerability is relatively easy to exploit, so potential for exploitation exists.
Refer to the official SurveyJS security advisory for detailed information and updates: [https://surveyjs.io/security/CVE-2025-13205](https://surveyjs.io/security/CVE-2025-13205)
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。