CVE-2025-13194

Executive Summary

CVE-2025-13194 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress, up to and including version 2.5.2. The vulnerability exists due to missing nonce verification on the SurveyJS_RenameSurvey AJAX action. This allows an unauthenticated attacker to rename surveys by tricking a site administrator into performing an action, such as clicking a malicious link. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from the official repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (administrator must click a link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (survey renaming)
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction and only allows renaming of surveys, not data exfiltration or privilege escalation. However, it could be used as part of a larger attack chain.

Deep Dive & Mechanics

The vulnerability resides in the SurveyJS_RenameSurvey AJAX action handler. In WordPress, AJAX actions that modify data should include a nonce (a one-time token) to verify the request originates from an authenticated user. The SurveyJS_RenameSurvey action lacks this nonce check, making it vulnerable to CSRF.

Attack Flow:

1. An attacker crafts a malicious link or form that triggers the SurveyJS_RenameSurvey AJAX action with a new survey name.
2. The attacker tricks a logged-in WordPress administrator into clicking the link or submitting the form.
3. The administrator's browser sends the forged request to the WordPress site.
4. The server processes the request without verifying the nonce, renaming the specified survey.

Impact: An attacker can rename any survey on the site. While this does not directly lead to data theft, it can cause confusion, disrupt form functionality, or be used in social engineering attacks.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.5.2):

add_action('wp_ajax_SurveyJS_RenameSurvey', 'surveyjs_rename_survey');
function surveyjs_rename_survey() {
    // No nonce verification
    $survey_id = $_POST['survey_id'];
    $new_name = $_POST['new_name'];
    // ... rename logic
}

Patched Code (Hypothetical):

add_action('wp_ajax_SurveyJS_RenameSurvey', 'surveyjs_rename_survey');
function surveyjs_rename_survey() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'surveyjs_rename_survey_nonce')) {
        wp_die('Security check failed');
    }
    $survey_id = $_POST['survey_id'];
    $new_name = $_POST['new_name'];
    // ... rename logic
}

The patch adds a nonce check using wp_verify_nonce() before processing the request.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with SurveyJS plugin version <= 2.5.2.
• A logged-in administrator account.

Exploitation Steps:

1. Craft a malicious HTML page or email containing a link that triggers the AJAX action:

   <form action="http://target-site/wp-admin/admin-ajax.php" method="POST">
       <input type="hidden" name="action" value="SurveyJS_RenameSurvey">
       <input type="hidden" name="survey_id" value="1">
       <input type="hidden" name="new_name" value="Hacked Survey">
       <input type="submit" value="Click me">
   </form>
   <script>document.forms[0].submit();</script>
   

2. Send the link to the administrator (e.g., via email or social engineering).
3. Once the administrator clicks, the survey is renamed.

Note: No public exploit code is available.

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action=SurveyJS_RenameSurvey from non-admin IPs or without a valid nonce.
• Check server logs for survey_id and new_name parameters in POST requests.

Hunting:

• Search for SurveyJS_RenameSurvey in web server access logs.
• Look for multiple rename attempts in a short period.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=SurveyJS_RenameSurvey.
  • Parameters: survey_id (integer) and new_name (string).
• Host:
  • Modified survey names in the WordPress database (table wp_surveyjs_surveys or similar).
• Logs:
  • Web server logs showing admin-ajax.php requests with SurveyJS_RenameSurvey action.

Detection Engineering

YARA Rule

rule CVE_2025_13194_SurveyJS_CSRF {
    meta:
        description = "Detects SurveyJS CSRF vulnerability exploitation attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13194"
    strings:
        $ajax_action = "SurveyJS_RenameSurvey"
        $wp_ajax = "wp_ajax_SurveyJS_RenameSurvey"
    condition:
        any of them
}

Sigma Rule

title: SurveyJS CSRF Rename Survey Attempt
id: 8a7b3c2d-1e5f-4a6b-9c8d-7e0f1a2b3c4d
status: experimental
description: Detects CSRF attempts against SurveyJS plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=SurveyJS_RenameSurvey'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13194 SurveyJS CSRF Rename Survey"; flow:to_server; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; http.client_body; content:"action=SurveyJS_RenameSurvey"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update immediately.
2. Disable the plugin: If no patch is available, consider disabling the SurveyJS plugin until a fix is released.
3. Web Application Firewall (WAF): Block requests to admin-ajax.php with action=SurveyJS_RenameSurvey from unauthenticated users.

Long-term Measures:

• Implement CSRF nonces in all AJAX actions.
• Use WordPress's built-in check_ajax_referer() function.
• Educate administrators about phishing attacks.

Workaround:

• Add a custom function to your theme's functions.php to add nonce verification:

  add_action('wp_ajax_SurveyJS_RenameSurvey', 'custom_surveyjs_rename_survey', 1);
  function custom_surveyjs_rename_survey() {
      check_ajax_referer('surveyjs_rename_survey_nonce', 'security');
  }
  

Valters IT
Securing Digital Frontiers