Surfer <= 1.3.2.357 - Missing Authorization

The Surfer plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on several functions, such as remove_post_draft_connection, check_draft_status, get_locations, get_ajax_surfer_connect_url, disconnect_surfer_from_wp, and check_connection_status called via AJAX actions in versions up to, and including, 1.3.2.357. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the connection details for the plugin and check the status details of posts.