The SurveyJS: Drag & Drop WordPress Form Builder plugin contains a Cross‑Site Request Forgery vulnerability in its SurveyJS_AddSurvey AJAX action. The flaw arises from a missing nonce check, allowing an attacker to forge a request that creates a new survey. The attacker requires no prior privileges; any user who can convince a site administrator to click a malicious link can trigger the vulnerability.

All releases of SurveyJS: Drag & Drop WordPress Form Builder up to and including version 2.5.2, distributed by devsoftbaltic. WordPress sites that have this plugin installed and activated are vulnerable. The problem is localized to the plugin’s AJAX endpoint that handles new survey submissions.

The CVSS score of 4.3 denotes a low impact, and the EPSS score is less than 1 %, indicating a low likelihood of exploitation under normal conditions. Nevertheless, the vulnerability can be triggered in a typical web browser, enabling unauthenticated CSRF to add a survey. It is not listed in the CISA KEV catalog, but administrators should still patch promptly because the attack requires only a user‑friendly click on a crafted link.