Sensitive API Credential Exposure in Surfer WordPress Plugin by Plugin Developer
CVE-2026-118639
Key Information:
Badges
What is CVE-2026-118639?
The Surfer WordPress plugin prior to version 1.8.1.759 contains a vulnerability that inadvertently exposes sensitive API credentials to users with limited access, such as contributors. This exposure occurs through the post editor page. The vulnerability relies on these credentials as the only means of authorizing access to its privileged REST API, permitting users with contributor-level access or higher to read the credentials. This situation enables unauthorized users to escalate privileges and perform actions such as publishing arbitrary posts.
Affected Version(s)
Surfer 0 < 1.8.1.759
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.