Is CVE-2026-5626 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5626 being exploited in the wild.

How severe is CVE-2026-5626?

Medium severity, with a CVSS score of 4.3, published 29 July 2026.

Which products and versions are affected?

bPlugins Survey Form Block – collect answers and insights from your audience up to, and including, 1.0.1.

Is there a fix for CVE-2026-5626?

A patch was published on 2026-04-08: Version 1.0.2 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5626 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5626?

Check whether you run bPlugins Survey Form Block – collect answers and insights from your audience at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5626: bPlugins Survey Form Block missing authorization in get_all_data

CVE-2026-5626 · Severity: medium · CVSS 4.3 · Published 2026-07-29

The Survey Form Block plugin for WordPress, which allows site owners to create and manage surveys, contains a security flaw that permits unauthorized data access. An individual with a basic user account on the site can export all survey responses and internal database metadata. This could lead to the exposure of sensitive feedback or personal information collected from site visitors.

Vendors: bPlugins.

Quick answers

Is CVE-2026-5626 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5626 being exploited in the wild.
How severe is CVE-2026-5626?: Medium severity, with a CVSS score of 4.3, published 29 July 2026.
Which products and versions are affected?: bPlugins Survey Form Block – collect answers and insights from your audience up to, and including, 1.0.1.
Is there a fix for CVE-2026-5626?: A patch was published on 2026-04-08: Version 1.0.2 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5626 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5626?: Check whether you run bPlugins Survey Form Block – collect answers and insights from your audience at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Survey Form Block plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) within the SVBAjax.php component. Specifically, the get_all_data() function fails to implement a capability check to verify if the requesting user has administrative permissions. An authenticated attacker with Subscriber-level privileges or higher can trigger this function via an AJAX request to export the entirety of the survey submission database, including column metadata. The issue is addressed in version 1.0.2 by adding the necessary capability checks.

Affected products

bPlugins Survey Form Block – collect answers and insights from your audience up to, and including, 1.0.1

Timeline

2026-04-08: patched: Version 1.0.2 released to address the vulnerability.
2026-07-29: disclosed: Vulnerability published by Wordfence and NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.