CVE-2026-118639 · Package
NO FIX YET · SEE WHAT TO DO
The Surfer WordPress plugin before 1.8.1.759 exposes its sensitive API credential on the post editor page, where low-privileged users can read it. That same credential is the only check on the plugin's privileged REST API, so a contributor can publish arbitrary posts and perform other privileged actions.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Surfer WordPress plugin before 1.8.1.759 where contributor-level or higher accounts exist. The exposure comes from the post editor page and the plugin's REST API relying on the same credential, so sites without the plugin are not affected. Sites where only trusted administrators have accounts carry less risk, but the flaw still lets any contributor escalate.
Not affected if plugin-1.8.1.759-or-later, plugin-not-installed
Who cares self-hosted, surfer, wordpress
Surfer plugin below 1.8.1.759 as exposed1.8.1.759 or laterThe Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.