Surfer WordPress Plugin: Broken access control (CVE-2026-112222)

The Surfer WordPress plugin is vulnerable to a broken access control issue (CVE-2026-112222) where low-privileged users (Subscribers) can obtain the API access key used for plugin authentication. By visiting the profile page with a crafted post_type parameter, the API key is exposed within a rendered JavaScript object. This key can be used as a Bearer token for the plugin’s REST API endpoints.

Attack Chain

1. Attacker authenticates to the WordPress site as a user with the 'Subscriber' role.
2. Attacker performs a GET request to /wp-admin/profile.php?post_type=post.
3. The server renders the profile page including the wpsurfer JavaScript object.
4. The object contains the api_key property, exposing the wpsurfer_api_access_key configuration value.
5. Attacker extracts the key from the HTML response body.
6. Attacker uses the extracted key in a Bearer token header to query or post to the surferseo/v1 REST API endpoints.

Impact

Successful exploitation allows a low-privileged user to obtain administrative API access, potentially enabling unauthorized modification of site content through the plugin's REST API, such as importing posts.

Recommendation

• Audit WordPress user accounts to ensure only authorized individuals hold active Subscriber roles.
• Monitor web access logs for anomalous requests to /wp-admin/profile.php containing the post_type query parameter, especially from user accounts with the Subscriber role.
• Review plugin configurations and monitor the wpsurfer_api_access_key for indicators of compromise.
• Apply patches for the Surfer plugin as soon as the vendor makes them available.