CVE-2026-5626 in Survey Form Block Plugin
Summary
by MITRE • 07/29/2026
The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all survey submission data and column metadata.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The Survey Form Block plugin for WordPress presents a critical authorization vulnerability that undermines the security posture of affected systems. This flaw exists within the get_all_data() function where proper capability checks are absent, creating a pathway for unauthorized data access. The vulnerability affects all versions up to and including 10.1, making it a widespread concern across numerous installations. Attackers with Subscriber-level privileges or higher can exploit this weakness to extract comprehensive survey submission data along with associated column metadata, effectively bypassing intended access controls.
The technical nature of this vulnerability aligns with CWE-863, which addresses "Incorrect Authorization" in software systems. This specific implementation flaw represents a failure in the principle of least privilege, where the plugin does not properly verify whether authenticated users possess sufficient permissions to access sensitive survey data. The missing capability check means that any user account with Subscriber role or higher can execute the data export functionality without proper authorization validation, creating a significant information disclosure risk.
Operationally, this vulnerability enables attackers to harvest sensitive survey responses and metadata from WordPress installations. The impact extends beyond simple data exposure as survey forms often collect personal information, feedback, and other confidential data that organizations rely on for business operations, customer service, or compliance purposes. Attackers could leverage this access to gather intelligence about user behavior, organizational practices, or potentially identify individuals through the collected survey data. The vulnerability affects both the integrity and confidentiality aspects of the affected systems.
Mitigation strategies should prioritize immediate plugin updates to versions that address the capability check deficiency. Organizations must also implement additional security measures such as role-based access control reviews, monitoring for unusual export activities, and regular security audits of WordPress plugins. The ATT&CK framework categorizes this vulnerability under T1078 Valid Accounts, where attackers exploit legitimate user accounts with sufficient privileges to access restricted data. Security teams should monitor authentication logs for suspicious export patterns and consider implementing network-level restrictions on data export functions. Additionally, organizations should conduct comprehensive vulnerability assessments of their WordPress environments to identify similar authorization flaws in other plugins or custom code implementations.