{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/surfer-plugin-3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:surferseo:surfer:3.1:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":5.4,"id":"CVE-2026-112222"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Surfer plugin (3.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Surfer"],"content_html":"\u003cp\u003eThe Surfer WordPress plugin is vulnerable to a broken access control issue (CVE-2026-112222) where low-privileged users (Subscribers) can obtain the API access key used for plugin authentication. By visiting the profile page with a crafted \u003ccode\u003epost_type\u003c/code\u003e parameter, the API key is exposed within a rendered JavaScript object. This key can be used as a Bearer token for the plugin’s REST API endpoints.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the WordPress site as a user with the 'Subscriber' role.\u003c/li\u003e\n\u003cli\u003eAttacker performs a GET request to \u003ccode\u003e/wp-admin/profile.php?post_type=post\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server renders the profile page including the \u003ccode\u003ewpsurfer\u003c/code\u003e JavaScript object.\u003c/li\u003e\n\u003cli\u003eThe object contains the \u003ccode\u003eapi_key\u003c/code\u003e property, exposing the \u003ccode\u003ewpsurfer_api_access_key\u003c/code\u003e configuration value.\u003c/li\u003e\n\u003cli\u003eAttacker extracts the key from the HTML response body.\u003c/li\u003e\n\u003cli\u003eAttacker uses the extracted key in a \u003ccode\u003eBearer\u003c/code\u003e token header to query or post to the \u003ccode\u003esurferseo/v1\u003c/code\u003e REST API endpoints.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged user to obtain administrative API access, potentially enabling unauthorized modification of site content through the plugin's REST API, such as importing posts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit WordPress user accounts to ensure only authorized individuals hold active Subscriber roles.\u003c/li\u003e\n\u003cli\u003eMonitor web access logs for anomalous requests to \u003ccode\u003e/wp-admin/profile.php\u003c/code\u003e containing the \u003ccode\u003epost_type\u003c/code\u003e query parameter, especially from user accounts with the Subscriber role.\u003c/li\u003e\n\u003cli\u003eReview plugin configurations and monitor the \u003ccode\u003ewpsurfer_api_access_key\u003c/code\u003e for indicators of compromise.\u003c/li\u003e\n\u003cli\u003eApply patches for the Surfer plugin as soon as the vendor makes them available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T14:09:32Z","date_published":"2026-11-07T14:09:32Z","id":"https://feed.craftedsignal.io/briefs/2026-11-surfer-plugin-auth-bypass/","summary":"A broken access control vulnerability in the Surfer WordPress plugin (CVE-2026-112222) allows authenticated Subscribers to exfiltrate API keys via profile page requests and perform unauthorized REST API actions.","title":"Surfer WordPress Plugin: Broken access control (CVE-2026-112222)","url":"https://feed.craftedsignal.io/briefs/2026-11-surfer-plugin-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Surfer Plugin (3.1)","version":"https://jsonfeed.org/version/1.1"}