Surfer vulnerabilities

CVEs whose affected-version data names the Surfer package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-118639Medium· 6.5

yesterday

Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure

The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing us…

▾ SunlitEPSS 0.22%via CVEORG