CVE-2026-118639
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 06, 2026
Vendor
unknown
Description
The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.