The SurveyJS: Drag & Drop WordPress Form Builder plugin suffers from a CSRF vulnerability due to the absence of nonce validation on the SurveyJS_AddSurvey AJAX action. This flaw enables attackers to forge requests that create surveys without authentication, relying on social engineering to induce an administrator to trigger the malicious request. The vulnerability affects all plugin versions up to and including 2.5.2 and has been assigned CVE-2025-13139 with a medium severity rating (CVSS 4.3). No known exploits are reported in the wild, and no patch or remediation details have been provided.

An attacker can exploit this vulnerability to create surveys on a vulnerable WordPress site by tricking an administrator into clicking a crafted link or performing another action that triggers the forged request. This could lead to unauthorized content creation within the site, potentially impacting site integrity and user trust. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or content and consider implementing additional CSRF protections or monitoring for unusual survey creation activity.