The SurveyJS WordPress plugin, up to version 2.5.2, lacks a nonce check on the 'SurveyJS_RenameSurvey' AJAX endpoint, creating a Cross‑Site Request Forgery flaw (CWE‑352). This missing verification allows an unauthenticated attacker to send a forged request that, when an administrator follows a crafted link, triggers the survey renaming operation. The primary consequence is the unauthorized alteration of survey data, potentially disrupting form workflows and misleading site visitors, but it does not provide code execution or broader system compromise.

This vulnerability affects the devsoftbaltic SurveyJS: Drag & Drop Form Builder plugin for WordPress. All releases through and including 2.5.2 are impacted. No other vendors or products are listed.

The CVSS score of 4.3 indicates a low‑to‑medium impact level, rather than moderate, as per the CVE data. The EPSS score of below 1% indicates a currently low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is a typical CSRF scenario: the attacker convinces an authenticated admin to visit a crafted URL that submits the rename request. Because the action does not scan the request for a nonce, the server accepts it as legitimate, and the survey name is altered. Due to the necessity of an authenticated administrator and no additional privileges, the risk remains contained but still warrants attention.