---
id: CVE-2026-118639
title: >-
  Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key
  Disclosure
summary: >-
  The Surfer  WordPress plugin before 1.8.1.759 discloses a sensitive API
  credential to low-privileged users through the post editor page and relies on
  that same credential as the sole authorization for its privileged REST API,
  allowing us…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'
cvssSource: adp
cwe:
  - CWE-269
product: Surfer
affected:
  - Surfer < 1.8.1.759
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T11:45:57.750337Z'
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:58:26.462Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118639'
references:
  - url: 'https://wpscan.com/vulnerability/0cc6b6cd-ff1a-4f04-a2f5-62684abeb314/'
tags:
  - cve.org
ingestedAt: '2026-11-06T06:46:27.281Z'
epss: 0.00222
epssPercentile: 0.12876
---

## Overview

The Surfer  WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.

## Affected

- `Surfer < 1.8.1.759`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.