SurveyJS WordPress Plugin Cross-Site Request Forgery Vulnerability
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the SurveyJS: Drag & Drop WordPress Form Builder plugin, affecting all versions through 1.12.20. The vulnerability arises from inadequate nonce validation on the 'SurveyJS_CloneSurvey' AJAX action, allowing unauthenticated attackers to duplicate surveys by sending a forged request that tricks a site administrator into clicking a link.
Impact
Exploitation of this vulnerability allows for unauthorized duplication of surveys, potentially leading to misuse of survey data or functionality.
Added: Jan 24, 2026, 9:32 AM
Updated: Jan 24, 2026, 9:32 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
0.6exploitability
6.9remediation
0.0relevance
2.3threat
3.2urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.