PT-2025-46781 · WordPress · Survey Maker

German · Published 2025-11-13 · Updated 2025-11-13 · CVE-2025-12892

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Survey Maker plugin for WordPress versions up to and including 5.1.9.4

Description The software is susceptible to unauthorized data modification. This is due to a missing capability check within the deactivate plugin option() function. This allows unauthenticated attackers to update the ays survey maker upgrade plugin option.

Recommendations Update the Survey Maker plugin to a version later than 5.1.9.4.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12892

Affected Products

Survey Maker

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12892 · Security Note
• https://t.me/cveNotify/142626 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6abc7605-2daa-44a9-8f2f-cbaacbea9348?source=cve · Note
• https://t.me/CVEtracker/37208 · Telegram Post
• https://twitter.com/CVEnew/status/1988820396247048635 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988890019893838070 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3394078/survey-maker/tags/5.1.9.5/admin/class-survey-maker-admin.php?old=3389474&old_path=survey-maker%2Ftags%2F5.1.9.4%2Fadmin%2Fclass-survey-maker-admin.php · Note