Ays Pro Survey Maker contains an authentication bypass vulnerability that allows an attacker to spoof identities by forging credentials. By exploiting this flaw, an adversary can impersonate legitimate users and gain unauthorized access to survey creation, editing, or configuration functions. The impact is the loss of confidentiality and integrity over survey data and the potential to manipulate results. The vulnerability is identified as CWE-290, indicating an authorization bypass through user controlled data.

WordPress installations that use the Ays Pro Survey Maker plugin, versions from the earliest available release up to and including 5.1.6.3.

The CVSS score of 4.3 places this issue in the moderate range, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA KEV, but the potential for identity spoofing suggests that any exposed instance should be treated with caution. The attack vector is likely remote, accessed through the web interface of the plugin; the description does not explicitly state the specific request type, so the exact exploitation pathway is inferred from typical authentication bypass patterns.