CVE-2025-12891 is a missing authorization vulnerability (CWE-862) in the ays-pro Survey Maker WordPress plugin. The issue arises from the absence of a capability check on the 'ays_survey_show_results' AJAX endpoint, which permits unauthenticated users to view all survey submissions. This affects all plugin versions up to and including 5.1.9.4. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily on confidentiality. No integrity or availability impacts are noted. No patch or official fix details are available from the vendor at this time.

An unauthenticated attacker can access survey submission data through the vulnerable AJAX endpoint, leading to unauthorized disclosure of potentially sensitive information collected via surveys. There is no indication of impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the AJAX endpoint via web application firewall rules or other access controls to prevent unauthorized data exposure.