SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - 跨站请求伪造导致调查问卷删除
平台
wordpress
组件
surveyjs
修复版本
1.12.21
CVE-2025-13140 describes a Cross-Site Request Forgery (CSRF) vulnerability present in the SurveyJS: Drag & Drop WordPress Form Builder plugin. This flaw allows unauthenticated attackers to potentially delete surveys on a WordPress site if they can manipulate a site administrator into performing an action. The vulnerability impacts versions from 0.0.0 through 1.12.20, but a fix is available in version 1.20.27.
检测此 CVE 是否影响你的项目
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
影响与攻击场景翻译中…
The primary impact of this CSRF vulnerability is the unauthorized deletion of surveys. An attacker could craft a malicious link or embed a hidden form that, when visited or submitted by a logged-in administrator, would trigger the SurveyJS_DeleteSurvey AJAX action without proper authentication. This could lead to data loss and disruption of survey functionality. While the attacker needs to trick an administrator into performing the action, the potential for widespread survey deletion makes this a significant risk, particularly for sites relying heavily on survey data for critical business processes. The attack surface is broad, affecting any WordPress site using the vulnerable plugin version.
利用背景翻译中…
This vulnerability was publicly disclosed on December 2, 2025. There are currently no known public proof-of-concept exploits available. The CVSS score of 4.3 indicates a medium level of exploitability and impact. It has not been added to the CISA KEV catalog at the time of this writing. Active exploitation is not currently confirmed, but the ease of exploitation (requiring only social engineering of an administrator) suggests potential for future campaigns.
哪些人处于风险中翻译中…
WordPress sites utilizing the SurveyJS: Drag & Drop Form Builder plugin, particularly those with multiple administrators or shared hosting environments, are at increased risk. Sites that do not enforce strict access controls to the survey management area are also more vulnerable. Legacy WordPress installations running older versions of the plugin are especially susceptible.
检测步骤翻译中…
• wordpress / composer / npm:
grep -r "SurveyJS_DeleteSurvey" /var/www/html/wp-content/plugins/surveyjs-drag-and-drop-form-builder/• generic web:
curl -I https://example.com/wp-admin/admin-ajax.php?action=SurveyJS_DeleteSurvey&survey_id=123 | grep -i "200 ok"• wordpress / composer / npm:
wp plugin list --status=all | grep 'surveyjs-drag-and-drop-form-builder'攻击时间线
- Disclosure
disclosure
威胁情报
漏洞利用状态
EPSS
0.02% (3% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 无 — 无需认证，无需凭证即可利用。
- User Interaction
- 需要 — 受害者必须打开文件、点击链接或访问特制页面。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 无 — 无机密性影响。
- Integrity
- 低 — 攻击者可修改部分数据，影响有限。
- Availability
- 无 — 无可用性影响。
受影响的软件
软件包信息
- 活跃安装数
- 500
- 插件评分
- 4.7
- 需要WordPress版本
- 6.4+
- 兼容至
- 6.9.4
- 需要PHP版本
- 8.2+
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The recommended mitigation is to immediately upgrade the SurveyJS: Drag & Drop WordPress Form Builder plugin to version 1.20.27 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests to the SurveyJS_DeleteSurvey endpoint that lack a valid nonce. Additionally, restrict access to the survey management area to authorized personnel only. Regularly review WordPress user roles and permissions to ensure least privilege access. After upgrading, confirm the fix by attempting to delete a survey via a browser with no administrator privileges; the action should be denied.
修复方法
更新到 1.20.27 版本，或更新的修复版本
CVE 安全通讯
漏洞分析和关键警报直接发送到您的邮箱。
常见问题翻译中…
What is CVE-2025-13140 — CSRF in SurveyJS Drag & Drop Form Builder?
CVE-2025-13140 is a Cross-Site Request Forgery vulnerability in the SurveyJS Drag & Drop Form Builder plugin for WordPress, allowing attackers to delete surveys by tricking administrators.
Am I affected by CVE-2025-13140 in SurveyJS Drag & Drop Form Builder?
You are affected if you are using SurveyJS Drag & Drop Form Builder versions 0.0.0 through 1.12.20. Upgrade to mitigate the risk.
How do I fix CVE-2025-13140 in SurveyJS Drag & Drop Form Builder?
Upgrade the plugin to version 1.20.27 or later. As a temporary workaround, implement a WAF rule to block unauthorized requests to the SurveyJS_DeleteSurvey endpoint.
Is CVE-2025-13140 being actively exploited?
Active exploitation is not currently confirmed, but the vulnerability's ease of exploitation suggests potential for future attacks.
Where can I find the official SurveyJS advisory for CVE-2025-13140?
Refer to the official SurveyJS security advisory for detailed information and updates: [https://surveyjs.io/security/CVE-2025-13140](https://surveyjs.io/security/CVE-2025-13140)