{
 "id": "WPSEC-2026-1335",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1335/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1335/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1335/index.md",
 "title": "Surfer <= 1.8.0.744 - Authenticated (Contributor+) Sensitive Information Exposure of Surfer API Key via Post Editor Script Data",
 "description": "The Surfer plugin for WordPress is vulnerable to Sensitive Information Exposure via the wpsurfer script data printed on post editor screens in all versions up to, and including, 1.8.0.744. The data includes the site's full Surfer API key, and it is printed for every user who can open the editor of a supported post type. The same key is the bearer token that authorizes the plugin's REST endpoints. This makes it possible for authenticated attackers, with contributor-level access and above, to obtain the API key and use it to call the import_post, get_posts, disconnect_draft and disconnect REST endpoints. Through these they can create, overwrite or publish arbitrary posts, set arbitrary post meta, list posts and disconnect the site from Surfer.",
 "plugin": {
  "slug": "surferseo",
  "name": "Surfer",
  "full_name": "Surfer – WordPress Plugin",
  "wordpress_org": "https://wordpress.org/plugins/surferseo/",
  "advisories_url": "https://wpsec.com/vuln/plugin/surferseo/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/surferseo"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.1.759",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.1.759"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.1.759",
 "remediation": "Update to 1.8.1.759 or later.",
 "fix_released": "2026-10-19T07:23:20+00:00",
 "published": "2026-10-21T12:44:50+00:00",
 "updated": "2026-10-21T11:59:35.558941+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1335/",
  "https://plugins.svn.wordpress.org/surferseo/tags/1.8.1.759/",
  "https://wordpress.org/plugins/surferseo/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/surferseo",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}