CVE-2026-112222

MediumCVSS 5.4

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Summary

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Surfer: from n/a through 1.8.0.744.

Risk Assessment

Unauthorized users may access features or data they should not, potentially leading to SEO configuration changes or information disclosure. Only access to the WordPress installation with the plugin is required.

Recommendation

Upgrade the Surfer plugin beyond 1.8.0.744. Until patched, review and tighten role permissions and restrict access to the plugin's administrative features.

Other vulnerabilities in Surfer

CVE-2025-58603Medium
The Surfer (surferseo) plugin in versions up to 1.6.4.574 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS