Live › vulnerability › CVE-2026-112222
Go to dashboardThe Surfer SEO plugin (surferseo) is missing an authorization check on some functionality, so a user may reach actions they should not be allowed to perform. Sources say the flaw affects versions from n/a through 1.8.0.744 and rate it CVSS 5.4 (medium).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Surfer SEO (surferseo) plugin at version 1.8.0.744 or earlier. Sites without this plugin installed can skip it. The sources do not say which roles or configurations are required to trigger the flaw.
No product ranges from the sources yet.
1.8.0.744 are listed as affected1.8.0.744 once a patched release is published (sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.
This page as .md · .json · in your agent: get_signal("CVE-2026-112222")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.