Unauthorized Data Access in Survey Maker Plugin for WordPress

CVE-2025-12891

What is CVE-2025-12891?

The Survey Maker plugin for WordPress contains a critical flaw that allows unauthorized users to access sensitive survey results. This vulnerability arises from a missing capability check on the 'ays_survey_show_results' AJAX endpoint, which affects all versions up to and including 5.1.9.4. As a result, unauthenticated attackers could exploit this oversight to retrieve and view all submitted survey data, potentially compromising the privacy of respondents. It is crucial for users of the affected plugin to update to version 5.1.9.5 or later to mitigate this risk.

References