SurveyJS WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the SurveyJS: Drag & Drop WordPress Form Builder plugin, affecting all versions up to and including 1.12.20. The vulnerability arises from a lack of nonce verification on the 'SurveyJS_RenameSurvey' AJAX action, allowing unauthenticated attackers to rename surveys by sending a forged request, provided they can manipulate a site administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for unauthorized survey renaming, potentially leading to confusion or misuse of survey data.