CVE-2025-13194 is a CSRF vulnerability in the SurveyJS: Drag & Drop Form Builder WordPress plugin up to version 2.5.2. The issue arises because the AJAX action 'SurveyJS_RenameSurvey' lacks nonce verification, enabling attackers to forge requests that rename surveys without authentication. Exploitation requires social engineering to induce an administrator to trigger the malicious request. The vulnerability is rated medium severity with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can rename surveys on affected WordPress sites by tricking an administrator into clicking a crafted link. This impacts the integrity of survey data but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider implementing additional CSRF protections or disabling the vulnerable AJAX action if possible.