CVE-2026-118639
Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.
| Vendor | unknown |
| Product | surfer |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown surfer
Be the first to know when new unknown vulnerabilities affecting unknown surfer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Surfer
0 < 1.8.1.759
References
Credits
Usama Arshad WPScan