The Survey Form Block plugin for WordPress allows subscribers and higher‑level users to trigger the get_all_data() function without performing a required capability check. Consequently, any authenticated subscriber can download every survey submission record along with metadata, leaking potentially sensitive user responses. This uncontrolled export is a direct result of a missing authorization guard (CWE‑862) and violates confidentiality expectations for the plugin.

Affected are all instances of the bplugins Survey Form Block plugin with a version of 1.0.1 or earlier. The issue is present in every release up to and inclusive of 1.0.1. Users running these versions on WordPress sites are able to export survey data without additional controls.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The exploit requires only an authenticated account with at least Subscriber level; the extent to which such accounts exist and the risk of widespread exposure cannot be determined from the available information. Administrators should therefore consider the risk of eligible users exporting data and take appropriate countermeasures.