The reported vulnerability in the Surfer plugin is a missing authorization flaw that allows an attacker to bypass the plugin’s access control mechanisms. An attacker who can reach the vulnerable plugin components could potentially perform actions or retrieve data that the user would normally be prohibited from accessing. The weakness is classified as CWE‑862, indicating a flaw in access control that may enable privilege escalation or unauthorized data exposure. The impact may range from viewing restricted content to modifying plugin settings, potentially affecting the confidentiality and integrity of the WordPress site.

The flaw exists in the Surfer Surferseo WordPress plugin provided by the vendor Surfer, distributed through WordPress up to and including version 1.6.4.574. Any WordPress installation that has this plugin installed in that version range is affected.

The CVSS score of 5.3 suggests a moderate risk profile. EPSS indicates a very low exploitation likelihood (under 1% at the time of this analysis), and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker would need to identify a reachable instance of the plugin and exploit the missing authorization controls, likely via the web interface or REST endpoints exposed by the plugin. Since no exploit was publicly demonstrated, theoretical exploitation remains the primary threat.