The Surfer WordPress plugin version before 1.8.1.759 reveals a sensitive API credential to users with only contributor permissions through the post editor interface. The same credential is the exclusive gatekeeper for a set of privileged REST API functions, enabling a contributor to access and execute actions typically reserved for higher‑level roles. This flaw allows an attacker who can log in as a contributor to read the API key and then leverage it to create, modify, or publish arbitrary content, effectively escalating privileges within the WordPress site.

All installations of the Surfer plugin running a version older than 1.8.1.759 are affected. The product is maintained by an unknown vendor and operates on WordPress platforms. Users with contributor or similar low‑privilege roles can exploit the flaw; administrators and higher‑level users are not directly impacted unless they grant contributors the same editor access.

The EPSS score is not available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting limited public exploitation data. Nevertheless, the attack vector is inferred to be via the WordPress editor page, which an authenticated contributor can access. Once the API key is exposed, the attacker can use the REST API to publish posts, modify content, or perform other actions with elevated privileges. The severity of the impact – arbitrary content control – indicates a high risk to the confidentiality, integrity, and availability of the site.