SurveyJS plugin introduces a missing authorization flaw that permits users to execute functions that should be restricted by access control lists. The vulnerability enables an attacker to reach sensitive administrative endpoints or to manipulate survey data without proper privileges. This flaw is categorized as CWE-862, an Authorization Bypass.

Systems running the devsoftbaltic SurveyJS WordPress plugin version 1.12.20 or earlier are vulnerable. The issue impacts any WordPress installation that has the plugin installed and activated, regardless of the site’s role configuration, as the access checks are not enforced on the plugin’s backend routes.

With a CVSS score of 5.3, the severity is moderate. The EPSS score is less than 1%, indicating that the exploit probability is low at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through HTTP requests to the plugin’s endpoints, and does not require authentication. An attacker can craft requests to bypass ACLs if the plugin does not check the current user’s permissions.