CVE-2025-58603

MediumCVSS 5.3

Published: 03/09/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The Surfer (surferseo) plugin in versions up to 1.6.4.574 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker could access functions or data they are not authorized to, potentially leading to unauthorized actions.

Recommendation

Update the Surfer plugin to a version newer than 1.6.4.574 if available, or fix the access control configuration.

Other vulnerabilities in Surfer

CVE-2026-112222Medium
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Surfer: from n/a through 1.8.0.744.

Original NVD description (English source)

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.6.4.574.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS