Cpe:2.3:a:surferseo:surfer:3.1:*:*:*:*:wordpress:*:*

A broken access control vulnerability in the Surfer WordPress plugin (CVE-2026-112222) allows authenticated Subscribers to exfiltrate API keys via profile page requests and perform unauthorized REST API actions.