Surfer <= 1.8.0.744 - Authenticated (Contributor+) Sensitive Information Exposure of Surfer API Key via Post Editor Script Data
- ID
- WPSEC-2026-1335
- Plugin
- Surfer – WordPress Plugin (surferseo)
- Affected
- all versions before 1.8.1.759
- Remediation
- Update to 1.8.1.759 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Surfer on WPSec AttackSurface
- Fix released
- Published
Description
The Surfer plugin for WordPress is vulnerable to Sensitive Information Exposure via the wpsurfer script data printed on post editor screens in all versions up to, and including, 1.8.0.744. The data includes the site's full Surfer API key, and it is printed for every user who can open the editor of a supported post type. The same key is the bearer token that authorizes the plugin's REST endpoints. This makes it possible for authenticated attackers, with contributor-level access and above, to obtain the API key and use it to call the import_post, get_posts, disconnect_draft and disconnect REST endpoints. Through these they can create, overwrite or publish arbitrary posts, set arbitrary post meta, list posts and disconnect the site from Surfer.
References
- https://wpsec.com/vuln/WPSEC-2026-1335/
- https://plugins.svn.wordpress.org/surferseo/tags/1.8.1.759/
- https://wordpress.org/plugins/surferseo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS