CVE-2025-12892: falha de média gravidade em ays-pro Survey Maker
Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
probabilidade de exploração
0.2%top 88% das CVEs
exploração observada
nãonenhuma fonte reporta
The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to update the ays_survey_maker_upgrade_plugin option.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
ays-pro · Survey MakerCVEs relacionadas — ays-pro Survey Maker
No mesmo produto, das mais perigosas para as menos.
CVE-2023-0038HIGHSurvey Maker – Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.7%CVE-2024-8488MEDIUMSurvey Maker – Customer Satisfaction Questionnaire, Chat Survey, Calculation Form, Payment Forms <= 4.9.7 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-13505MEDIUMSurvey Maker <= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey QuestionEPSS 0.3%CVE-2025-12891MEDIUMSurvey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Information ExposureEPSS 0.2%
Referências
https://plugins.trac.wordpress.org/changeset/3394078/survey-maker/tags/5.1.9.5/admin/class-survey-maker-admin.php?old=3389474&old_path=survey-maker%2Ftags%2F5.1.9.4%2Fadmin%2Fclass-survey-maker-admin.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/6abc7605-2daa-44a9-8f2f-cbaacbea9348?source=cve