Executive brief
The Survey Form Block plugin for WordPress, which allows site owners to create and manage surveys, contains a security flaw that permits unauthorized data access. An individual with a basic user account on the site can export all survey responses and internal database metadata. This could lead to the exposure of sensitive feedback or personal information collected from site visitors.
Technical details
The Survey Form Block plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) within the SVBAjax.php component. Specifically, the get_all_data() function fails to implement a capability check to verify if the requesting user has administrative permissions. An authenticated attacker with Subscriber-level privileges or higher can trigger this function via an AJAX request to export the entirety of the survey submission database, including column metadata. The issue is addressed in version 1.0.2 by adding the necessary capability checks.
Affected products
- bPlugins Survey Form Block – collect answers and insights from your audience up to, and including, 1.0.1
Timeline
- 2026-04-08: patched: Version 1.0.2 released to address the vulnerability.
- 2026-07-29: disclosed: Vulnerability published by Wordfence and NVD.
References
- https://plugins.trac.wordpress.org/browser/survey-form-block/tags/1.0.1/inc/SVBAjax.php
- https://plugins.trac.wordpress.org/browser/survey-form-block/trunk/inc/SVBAjax.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3502334%40survey-form-block%2Ftrunk%2Finc%2FSVBAjax.php&old=3223297%40survey-form-block%2Ftrunk%2Finc%2FSVBAjax.php
- https://wordpress.org/plugins/survey-form-block/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e98d4f04-74cd-486f-bb2f-fad76895f386?source=cve