Unauthorized Data Access in Survey Maker Plugin for WordPress

CVE-2025-12891

What is CVE-2025-12891?

The Survey Maker plugin for WordPress contains a critical flaw that allows unauthorized users to access sensitive survey results. This vulnerability arises from a missing capability check on the 'ays_survey_show_results' AJAX endpoint, which affects all versions up to and including 5.1.9.4. As a result, unauthenticated attackers could exploit this oversight to retrieve and view all submitted survey data, potentially compromising the privacy of respondents. It is crucial for users of the affected plugin to update to version 5.1.9.5 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References