CVE-2025-12891
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The WordPress plugin Survey Maker is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to and including 5.1.9.4. This allows unauthenticated attackers to view all survey submissions.
Risk Assessment
An unauthenticated attacker can access all survey submissions, potentially leading to leakage of personal or confidential information. The risk affects all sites with the vulnerable plugin version.
Recommendation
Update the Survey Maker plugin to a version newer than 5.1.9.4. Until the update, consider disabling the 'ays_survey_show_results' endpoint or restricting access to it.
Other vulnerabilities in Survey Maker
See all- CVE-2026-65565High
Unauthenticated Cross Site Scripting (XSS) in Survey Maker versions up to 5.2.3.3.
- CVE-2026-57361High
The Survey Maker plugin for WordPress versions 5.2.2.5 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. It allows a remote attacker to inject malicious script without requiring authentication.
- CVE-2025-64276Medium
The WordPress plugin Survey Maker (survey-maker) by Ays Pro contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. The issue affects versions up to and including 5.1.9.4.
Original NVD description (English source)
The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to view all survey submissions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS