{"id":"CVE-2026-118639","kind":"vulnerability","aliases":["CVE-2026-118639"],"related":[],"title":"Surfer WordPress plugin leaks API credential to contributors, enabling privileged actions","description":"The Surfer  WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.","summary":"The Surfer WordPress plugin before 1.8.1.759 exposes its sensitive API credential on the post editor page, where low-privileged users can read it. That same credential is the only check on the plugin's privileged REST API, so a contributor can publish arbitrary posts and perform other privileged actions.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","surfer","wordpress"],"not_affected_if":["plugin-1.8.1.759-or-later","plugin-not-installed"],"how_to_check":"- Check the installed Surfer plugin version in the WordPress admin Plugins page; unknown whether a specific file path reveals it\n- Treat any installed `Surfer` plugin below `1.8.1.759` as exposed\n- Review which accounts hold contributor-level access or above on the site","fix":"- Surfer plugin: move to `1.8.1.759` or later","status":"open","published_at":"2026-11-06T06:16:41+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:48+00:00","updated_at":"2026-11-06T06:41:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:41:48Z","model":"claude-haiku-5-5","output":{"fix":"- Surfer plugin: move to `1.8.1.759` or later","reach":"internet","title":"Surfer WordPress plugin leaks API credential to contributors, enabling privileged actions","impact":"high","summary":"The Surfer WordPress plugin before 1.8.1.759 exposes its sensitive API credential on the post editor page, where low-privileged users can read it. That same credential is the only check on the plugin's privileged REST API, so a contributor can publish arbitrary posts and perform other privileged actions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","surfer","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"contributor publishes arbitrary posts and performs privileged plugin actions","analyst_note":"Confirm the exact fixed version and the specific REST endpoints and affected plugin settings from the vendor or NVD advisory.","how_to_check":"- Check the installed Surfer plugin version in the WordPress admin Plugins page; unknown whether a specific file path reveals it\n- Treat any installed `Surfer` plugin below `1.8.1.759` as exposed\n- Review which accounts hold contributor-level access or above on the site","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-1.8.1.759-or-later"],"who_is_affected":"Sites running the Surfer WordPress plugin before 1.8.1.759 where contributor-level or higher accounts exist. The exposure comes from the post editor page and the plugin's REST API relying on the same credential, so sites without the plugin are not affected. Sites where only trusted administrators have accounts carry less risk, but the flaw still lets any contributor escalate.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4234,"output_tokens":651,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118639':14A,17A '-2026':13A,16A '1.8.1.759':29B,79C 'access':116C 'action':11A,73B,132C 'allow':110C 'api':5A,33B,61B,83C,109C 'arbitrari':67B,127C 'author':104C 'check':54B 'contributor':8A,64B,114C 'contributor-level':113C 'credenti':6A,34B,50B,84C,100C,122C 'cve':12A,15A 'disclos':80C 'editor':38B,93C 'enabl':9A 'escal':124C 'expos':30B 'host':21B 'leak':4A 'level':115C 'low':42B,87C 'low-privileg':41B,86C 'packag':18B 'page':39B,94C 'perform':70B 'plugin':3A,27B,57B,77C 'post':37B,68B,92C,128C 'privileg':10A,43B,59B,72B,88C,107C,131C 'publish':66B,126C 'read':46B,120C 'reli':96C 'rest':60B,108C 'self':20B 'self-host':19B 'sensit':32B,82C 'sole':103C 'surfer':1A,22B,25B,75C 'user':44B,89C,111C 'wordpress':2A,23B,26B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Surfer WordPress plugin before 1.8.1.759 where contributor-level or higher accounts exist. The exposure comes from the post editor page and the plugin's REST API relying on the same credential, so sites without the plugin are not affected. Sites where only trusted administrators have accounts carry less risk, but the flaw still lets any contributor escalate.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","surfer","wordpress"],"campaign_type":null,"search_a":"'-118639':14A,17A '-2026':13A,16A 'action':11A 'api':5A 'contributor':8A 'credenti':6A 'cve':12A,15A 'enabl':9A 'leak':4A 'plugin':3A 'privileg':10A 'surfer':1A 'wordpress':2A","search_b":"'1.8.1.759':29B 'action':73B 'api':33B,61B 'arbitrari':67B 'check':54B 'contributor':64B 'credenti':34B,50B 'editor':38B 'expos':30B 'host':21B 'low':42B 'low-privileg':41B 'packag':18B 'page':39B 'perform':70B 'plugin':27B,57B 'post':37B,68B 'privileg':43B,59B,72B 'publish':66B 'read':46B 'rest':60B 'self':20B 'self-host':19B 'sensit':32B 'surfer':22B,25B 'user':44B 'wordpress':23B,26B","search_c":"'1.8.1.759':79C 'access':116C 'action':132C 'allow':110C 'api':83C,109C 'arbitrari':127C 'author':104C 'contributor':114C 'contributor-level':113C 'credenti':84C,100C,122C 'disclos':80C 'editor':93C 'escal':124C 'level':115C 'low':87C 'low-privileg':86C 'page':94C 'plugin':77C 'post':92C,128C 'privileg':88C,107C,131C 'publish':126C 'read':120C 'reli':96C 'rest':108C 'sensit':82C 'sole':103C 'surfer':75C 'user':89C,111C 'wordpress':76C","first_public_at":"2026-11-06T06:16:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118639","severity":null,"published_at":"2026-11-06T06:16:41+00:00","modified_at":"2026-11-06T06:16:41+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}