{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12892", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-07T18:09:46.759Z", "datePublished": "2025-11-13T03:27:38.242Z", "dateUpdated": "2026-04-08T16:58:53.744Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:53.744Z"}, "affected": [{"vendor": "ays-pro", "product": "Survey Maker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.1.9.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to update the ays_survey_maker_upgrade_plugin option."}], "title": "Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6abc7605-2daa-44a9-8f2f-cbaacbea9348?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3394078/survey-maker/tags/5.1.9.5/admin/class-survey-maker-admin.php?old=3389474&old_path=survey-maker%2Ftags%2F5.1.9.4%2Fadmin%2Fclass-survey-maker-admin.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "German"}], "timeline": [{"time": "2025-11-07T18:24:54.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-12T14:58:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-13T14:27:35.321452Z", "id": "CVE-2025-12892", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T14:34:24.665Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12892", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-13T14:27:35.321452Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T14:27:37.298Z"}}], "cna": {"title": "Survey Maker <= 5.1.9.4 - Missing Authorization Unauthenticated Limited Option Update", "credits": [{"lang": "en", "type": "finder", "value": "German"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "ays-pro", "product": "Survey Maker", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.1.9.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-07T18:24:54.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-12T14:58:49.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6abc7605-2daa-44a9-8f2f-cbaacbea9348?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3394078/survey-maker/tags/5.1.9.5/admin/class-survey-maker-admin.php?old=3389474&old_path=survey-maker%2Ftags%2F5.1.9.4%2Fadmin%2Fclass-survey-maker-admin.php"}], "descriptions": [{"lang": "en", "value": "The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to update the ays_survey_maker_upgrade_plugin option."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-13T03:27:38.242Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12892", "state": "PUBLISHED", "dateUpdated": "2025-11-13T14:34:24.665Z", "dateReserved": "2025-11-07T18:09:46.759Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-13T03:27:38.242Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to update the ays_survey_maker_upgrade_plugin option."}], "id": "CVE-2025-12892", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-13T04:15:46.537", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3394078/survey-maker/tags/5.1.9.5/admin/class-survey-maker-admin.php?old=3389474&old_path=survey-maker%2Ftags%2F5.1.9.4%2Fadmin%2Fclass-survey-maker-admin.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6abc7605-2daa-44a9-8f2f-cbaacbea9348?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:33:43.319210+00:00", "value": {"mitigation_remediation": ["Upgrade Survey Maker to version 5.1.9.5 or newer, which removes the missing capability check.", "If an upgrade is not immediately possible, restrict access to the WordPress admin area with server\u2011side authentication or firewall rules so only authenticated personnel can reach the plugin\u2019s administration endpoints.", "Verify that the ays_survey_maker_upgrade_plugin option remains at its intended default value and revert it if it has been modified."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Configuration Modification"}, "threat_synthesis": {"affected_systems": "All releases of Survey Maker by ays-pro up to and including version 5.1.9.4 are affected. Any WordPress site running those versions is susceptible unless the plugin has been updated or the option is otherwise protected.", "description_and_impact": "The Survey Maker plugin for WordPress contains a missing capability check in its deactivate_plugin_option() function, allowing any unauthenticated web user to modify the ays_survey_maker_upgrade_plugin option. This option determines whether the plugin is permitted to upgrade itself. By changing it, a malicious actor could force the plugin to automatically install a tampered or malicious version in the future, providing a foothold for further compromise. The vulnerability is a classic authorization issue (CWE\u2011862) and does not provide direct code execution, but it enables an attacker to alter configuration to facilitate later attacks.", "risk_and_exploitability": "The CVSS score of 5.3 indicates medium severity; the EPSS score of <1% suggests a low probability of exploitation at present, and the vulnerability is not listed in CISA KEV. The attack vector is likely an unauthenticated HTTP request to the plugin\u2019s admin API endpoint, where the missing capability check allows the option to be updated without authentication."}}}}, "created": "2025-11-13T09:52:05.702506+00:00", "updated": "2026-04-22T00:45:04.150669+00:00", "vendors": ["ays-pro", "ays-pro$PRODUCT$survey_maker", "wordpress", "wordpress$PRODUCT$wordpress"]}