CVE-2026-118639: Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure

Q: Who can exploit this issue?

An attacker needs contributor-level access or higher on a WordPress site using an affected Surfer plugin version. They must be able to access the post editor page to obtain the disclosed API credential.

Q: What can an attacker do after obtaining the credential?

The credential is the sole authorization check for the plugin's privileged REST API. A contributor or higher-level user can use it to publish arbitrary posts and perform other privileged actions exposed through that API.

Q: Are sites running Surfer 1.8.1.759 or later affected?

The issue is described as affecting Surfer versions before 1.8.1.759. Sites should update to version 1.8.1.759 or a later version if available.

Q: How can I determine whether my site may already be exposed?

Check whether the installed Surfer version is earlier than 1.8.1.759 and whether contributor-or-higher accounts can access the post editor. Review those accounts and activity involving unexpected post publication or other privileged actions through the plugin's REST API.

Published Nov 6, 2026

Updated

The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs contributor-level access or higher on a WordPress site using an affected Surfer plugin version. They must be able to access the post editor page to obtain the disclosed API credential.

What can an attacker do after obtaining the credential?

The credential is the sole authorization check for the plugin's privileged REST API. A contributor or higher-level user can use it to publish arbitrary posts and perform other privileged actions exposed through that API.

Are sites running Surfer 1.8.1.759 or later affected?

The issue is described as affecting Surfer versions before 1.8.1.759. Sites should update to version 1.8.1.759 or a later version if available.

How can I determine whether my site may already be exposed?

Check whether the installed Surfer version is earlier than 1.8.1.759 and whether contributor-or-higher accounts can access the post editor. Review those accounts and activity involving unexpected post publication or other privileged actions through the plugin's REST API.

CVE-2026-118639: Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do after obtaining the credential?

Are sites running Surfer 1.8.1.759 or later affected?

How can I determine whether my site may already be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do after obtaining the credential?

Are sites running Surfer 1.8.1.759 or later affected?

How can I determine whether my site may already be exposed?