CVE-2025-13140

Executive Summary

CVE-2025-13140 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress, up to and including version 1.12.20. The vulnerability exists in the SurveyJS_DeleteSurvey AJAX action, which lacks proper nonce validation. This allows an unauthenticated attacker to forge a request that, when triggered by a logged-in site administrator (e.g., by clicking a malicious link), can delete arbitrary surveys from the WordPress site. The CVSS score is 4.3 (Medium), with a low impact on integrity and no impact on confidentiality or availability. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are affected. The plugin is not distributed via NPM, PyPI, Go, or Ruby registries. Administrators should verify the plugin version and apply any available updates from the WordPress plugin repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the attacker must trick an administrator into clicking a link or performing an action.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – deletion of surveys.
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction (social engineering) to exploit, but once triggered, an attacker can delete surveys without authentication. This could lead to loss of important survey data and potential reputational damage.

Deep Dive & Mechanics

The vulnerability resides in the SurveyJS_DeleteSurvey AJAX action handler within the SurveyJS plugin. In WordPress, AJAX actions that perform sensitive operations (like deleting data) should include a nonce (a one-time token) to verify that the request originated from the legitimate admin interface. The plugin fails to implement this nonce check, making the action vulnerable to CSRF.

How it works:

1. An attacker crafts a malicious link or form that sends a POST request to the WordPress admin AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to SurveyJS_DeleteSurvey and a survey ID.
2. The attacker tricks a logged-in administrator into clicking the link or submitting the form (e.g., via email, social media, or a compromised site).
3. The administrator's browser sends the forged request, including their valid WordPress cookies.
4. The server processes the request without verifying a nonce, and the survey is deleted.

Root Cause: Missing nonce validation in the SurveyJS_DeleteSurvey AJAX callback function.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.12.20):

add_action('wp_ajax_SurveyJS_DeleteSurvey', 'surveyjs_delete_survey');
function surveyjs_delete_survey() {
    // No nonce check here
    $survey_id = intval($_POST['survey_id']);
    // Delete survey logic...
    wp_delete_post($survey_id, true);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_SurveyJS_DeleteSurvey', 'surveyjs_delete_survey');
function surveyjs_delete_survey() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'surveyjs_delete_survey')) {
        wp_die('Security check failed.');
    }
    $survey_id = intval($_POST['survey_id']);
    // Delete survey logic...
    wp_delete_post($survey_id, true);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with SurveyJS plugin version <= 1.12.20.
• A logged-in administrator account (the victim).
• Ability to deliver a crafted link to the victim.

Exploit Steps:

1. Identify a target survey ID (e.g., by observing the admin interface or using a previous CSRF to enumerate).
2. Craft a malicious HTML page or link that triggers the AJAX request:

   <form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf-form">
       <input type="hidden" name="action" value="SurveyJS_DeleteSurvey">
       <input type="hidden" name="survey_id" value="123">
   </form>
   <script>document.getElementById('csrf-form').submit();</script>
   

3. Host the page or send the link to the victim administrator.
4. When the victim visits the page while logged in, the survey with ID 123 is deleted.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection:

• Monitor AJAX requests to /wp-admin/admin-ajax.php with action=SurveyJS_DeleteSurvey.
• Look for requests without a valid _wpnonce parameter.
• Alert on multiple survey deletion requests from a single IP or user agent.

Prevention:

• Apply the vendor patch immediately when available.
• Implement a Web Application Firewall (WAF) rule to block requests to SurveyJS_DeleteSurvey without a valid nonce.
• Educate administrators about phishing and social engineering attacks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=SurveyJS_DeleteSurvey and a survey_id parameter.
  • Referer header missing or unexpected (e.g., from an external domain).
• Host:
  • Unexpected deletion of survey posts (custom post type survey).
  • Log entries showing wp_ajax_SurveyJS_DeleteSurvey calls without a nonce.
• File:
  • No specific file IOCs; the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule CVE_2025_13140_CSRF_SurveyJS {
    meta:
        description = "Detects CSRF exploitation attempts against SurveyJS DeleteSurvey AJAX action"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13140"
    strings:
        $ajax_action = "SurveyJS_DeleteSurvey"
        $wp_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $wp_ajax
}

Sigma Rule

title: CVE-2025-13140 - SurveyJS CSRF DeleteSurvey
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSRF attempts against SurveyJS DeleteSurvey AJAX action
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13140
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=SurveyJS_DeleteSurvey'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13140 - SurveyJS CSRF DeleteSurvey Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=SurveyJS_DeleteSurvey";
    http_client_body;
    sid:10000001;
    rev:1;
    reference:cve,2025-13140;
    classtype:attempted-admin;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: Check the WordPress plugin repository for an updated version of SurveyJS that includes a nonce check. If available, update immediately.
2. Disable the plugin: If no patch is available, temporarily deactivate the SurveyJS plugin until a fix is released.
3. Implement a WAF rule: Block POST requests to /wp-admin/admin-ajax.php that contain action=SurveyJS_DeleteSurvey and lack a valid nonce.

Long-term Measures:

• Enforce CSRF protection (nonce) on all AJAX actions that modify data.
• Conduct regular security audits of WordPress plugins.
• Educate administrators on recognizing phishing attempts.

Patch Status: UNKNOWN / UNPATCHED. Monitor the vendor's website and WordPress plugin repository for updates.

Valters IT
Securing Digital Frontiers