CVE-2026-118639

The Surfer WordPress plugin (versions before 1.8.1.759 ) contains a privilege escalation vulnerability. The plugin discloses a sensitive API credential to low-privileged users via the post editor page. Because the plugin relies on this specific credential as the sole authorization for its privile...

CVE-2026-118639 Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure

The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the...