CVE-2025-13205 is a CSRF vulnerability in the SurveyJS: Drag & Drop WordPress Form Builder plugin (versions up to 2.5.2). The vulnerability is due to missing or incorrect nonce validation on the AJAX action SurveyJS_CloneSurvey. This flaw allows unauthenticated attackers to cause an administrator to perform unintended actions, specifically duplicating surveys, by tricking them into clicking a crafted link. The CVSS 3.1 base score is 4.3 (medium severity), with attack vector network, low attack complexity, no privileges required, user interaction required, and impact limited to low integrity impact without confidentiality or availability impact.

An attacker can exploit this vulnerability to cause an authenticated administrator to duplicate surveys without their intent. This could lead to unwanted or malicious survey duplication, potentially affecting site content management or causing confusion. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links and consider implementing additional CSRF protections or monitoring for unusual survey duplication activity.