CVE-2026-112222: Missing Authorization in Surfer

CVE-2026-112222 is a Missing Authorization vulnerability in the Surfer WordPress plugin affecting all versions up to 1.8.0.744. The flaw allows unauthorized users to access protected functionality and data due to incorrectly configured access controls. Surfer plugin is widely used for SEO optimization, making this vulnerability relevant to thousands of corporate and publisher websites.

The vulnerability has a CVSS score of 5.4, classified as medium severity by the NVD community. While not critical, it represents a significant risk to data confidentiality and integrity. An important signal comes from GitHub: on 2026-11-07, a public PoC was reported by Mor Golan, indicating the exploitation method is known and documented. This concretely increases the likelihood of practical attacks in coming days.

Defenders should prioritize updating the Surfer plugin to versions after 1.8.0.744 as soon as they become available. In the short term, review access logs to detect any unauthorized access to sensitive functions. If immediate updating is not possible, consider disabling the plugin until an official patch is released. Monitor the official Surfer update channels carefully for fix notifications.