SurveyJS WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Survey Deletion

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the SurveyJS: Drag & Drop WordPress Form Builder plugin, affecting all versions through 1.12.20. The vulnerability arises from a lack of nonce validation in the SurveyJS_DeleteSurvey AJAX action, enabling unauthenticated attackers to delete surveys by sending a forged request that tricks a site administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of surveys by exploiting the CSRF weakness.

Remediation

Users are advised to update the SurveyJS: Drag & Drop WordPress Form Builder plugin to version 1.20.27 or a newer patched version.