The Survey Maker plugin for WordPress contains a missing capability check in its deactivate_plugin_option() function, allowing any unauthenticated web user to modify the ays_survey_maker_upgrade_plugin option. This option determines whether the plugin is permitted to upgrade itself. By changing it, a malicious actor could force the plugin to automatically install a tampered or malicious version in the future, providing a foothold for further compromise. The vulnerability is a classic authorization issue (CWE‑862) and does not provide direct code execution, but it enables an attacker to alter configuration to facilitate later attacks.

All releases of Survey Maker by ays-pro up to and including version 5.1.9.4 are affected. Any WordPress site running those versions is susceptible unless the plugin has been updated or the option is otherwise protected.

The CVSS score of 5.3 indicates medium severity; the EPSS score of <1% suggests a low probability of exploitation at present, and the vulnerability is not listed in CISA KEV. The attack vector is likely an unauthenticated HTTP request to the plugin’s admin API endpoint, where the missing capability check allows the option to be updated without authentication.