Vendor
A broken access control vulnerability in the Surfer WordPress plugin (CVE-2026-112222) allows authenticated Subscribers to exfiltrate API keys via profile page requests and perform unauthorized REST API actions.