# Surfer <= 1.8.0.744 - Authenticated (Contributor+) Sensitive Information Exposure of Surfer API Key via Post Editor Script Data

- **ID:** WPSEC-2026-1335
- **Plugin:** Surfer – WordPress Plugin (`surferseo`), https://wordpress.org/plugins/surferseo/
- **Affected versions:** all versions before 1.8.1.759
- **Fixed in:** 1.8.1.759 (Update to 1.8.1.759 or later.)
- **Severity:** High 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/surferseo
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1335/

## Description

The Surfer plugin for WordPress is vulnerable to Sensitive Information Exposure via the wpsurfer script data printed on post editor screens in all versions up to, and including, 1.8.0.744. The data includes the site's full Surfer API key, and it is printed for every user who can open the editor of a supported post type. The same key is the bearer token that authorizes the plugin's REST endpoints. This makes it possible for authenticated attackers, with contributor-level access and above, to obtain the API key and use it to call the import_post, get_posts, disconnect_draft and disconnect REST endpoints. Through these they can create, overwrite or publish arbitrary posts, set arbitrary post meta, list posts and disconnect the site from Surfer.

## References

- https://wpsec.com/vuln/WPSEC-2026-1335/
- https://plugins.svn.wordpress.org/surferseo/tags/1.8.1.759/
- https://wordpress.org/plugins/surferseo/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1335/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.