Surfer WordPress Plugin CVE-2026-112222

Exploitation requires an authenticated low-privileged account on a WordPress site running the Surfer plugin version n/a through 1.8.0.744 (PR:L). The flaw is an incorrectly configured access-control check on plugin functionality, so any authenticated user can reach the affected endpoint over the network without user interaction. Limiting factors: the attacker must first hold valid credentials (open registration or an existing low-tier role makes this trivial, but a locked-down site with no low-privilege accounts raises the bar), and impact is confined to low-level unauthorized data read/modification rather than full site takeover.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the Surfer WordPress plugin, rated CVSS 5.4 via vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The network vector and low attack complexity make it easy to reach, but PR:L means an attacker must already hold a low-privileged authenticated account (e.g. subscriber/contributor), which meaningfully constrains real-world risk. Impact is limited to low confidentiality and low integrity with no availability effect and no scope change, consistent with an unauthorized actor reaching functionality that should be access-controlled rather than full compromise. No EPSS score, KEV listing, or POC was provided in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation, so this reads as a real-but-not-urgent patch-management item rather than an emergency. The signals are internally consistent - the authenticated, limited-impact CVSS matches a broken-access-control issue - so there is no major conflict to flag, though the absence of EPSS/KEV/POC data means exploitation likelihood is an inference, not a measured value.

An attacker who has registered or obtained a low-privileged account on a WordPress site running Surfer ≤1.8.0.744 sends a crafted request directly to a plugin endpoint that fails to verify the caller's authorization level. Because the access-control check is missing, the attacker reaches functionality or data meant for higher-privileged users, enabling limited unauthorized read or modification. No public proof-of-concept was provided in the source data.