{"id":"CVE-2026-112222","kind":"vulnerability","aliases":["CVE-2026-112222"],"related":[],"title":"Surfer SEO WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.","summary":"The Surfer SEO plugin (surferseo) is missing an authorization check on some functionality, so a user may reach actions they should not be allowed to perform. Sources say the flaw affects versions from n/a through 1.8.0.744 and rate it CVSS 5.4 (medium).","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","surfer-seo","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Surfer SEO plugin version in the WordPress admin plugin list; versions up to `1.8.0.744` are listed as affected\n- unknown: the sources do not name the exact endpoint or setting involved","fix":"- Update the Surfer SEO plugin to a version later than `1.8.0.744` once a patched release is published (sources do not name the fixed version)\n- unknown: the sources do not state a fixed version","status":"open","published_at":"2026-10-19T14:17:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:16:48+00:00","updated_at":"2026-10-25T04:16:48+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:16:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Surfer SEO plugin to a version later than `1.8.0.744` once a patched release is published (sources do not name the fixed version)\n- unknown: the sources do not state a fixed version","reach":"unknown","title":"Surfer SEO WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"The Surfer SEO plugin (surferseo) is missing an authorization check on some functionality, so a user may reach actions they should not be allowed to perform. Sources say the flaw affects versions from n/a through 1.8.0.744 and rate it CVSS 5.4 (medium).","category":"package","nicknames":[],"who_cares":["wordpress","surfer-seo","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Low-privileged users may perform actions reserved for higher roles","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the exact affected endpoint and required role.","how_to_check":"- Check the installed Surfer SEO plugin version in the WordPress admin plugin list; versions up to `1.8.0.744` are listed as affected\n- unknown: the sources do not name the exact endpoint or setting involved","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Surfer SEO (surferseo) plugin at version 1.8.0.744 or earlier. Sites without this plugin installed can skip it. The sources do not say which roles or configurations are required to trigger the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000621,"input_tokens":3299,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112222':13A,16A '-2026':12A,15A '1.8.0.744':60B,88C '5.4':65B 'access':9A,78C 'action':43B 'affect':55B,83C 'allow':48B,74C 'author':6A,33B,68C 'check':7A,34B 'configur':77C 'control':10A,79C 'cve':11A,14A 'cvss':64B 'exploit':75C 'expos':8A 'flaw':54B 'function':37B 'host':20B 'incorrect':76C 'issu':82C 'levels.this':81C 'may':41B 'medium':66B 'miss':5A,31B,67C 'n/a':58B,86C 'packag':17B 'perform':50B 'plugin':4A,28B 'rate':62B 'reach':42B 'say':52B 'secur':80C 'self':19B 'self-host':18B 'seo':2A,23B,27B 'sourc':51B 'surfer':1A,22B,26B,71C,72C,84C 'surfer-seo':21B 'surferseo':29B,73C 'user':40B 'version':56B 'vulner':69C 'wordpress':3A,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Surfer SEO (surferseo) plugin at version 1.8.0.744 or earlier. Sites without this plugin installed can skip it. The sources do not say which roles or configurations are required to trigger the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112222","severity":null,"published_at":"2026-10-19T14:17:02+00:00","modified_at":"2026-10-19T15:17:05+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}