CVE-2026-121509
Deferred
Deferred - Pending Action
Information Disclosure in Headless CMS Plugin for WordPress
Vulnerability report for CVE-2026-121509, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-03
Last updated on: 2026-11-03
Assigner: VulDB
Description
Description
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| n/a | Headless CMS Plugin | 2.0.0 |
| n/a | Headless CMS Plugin | 2.0.1 |
| n/a | Headless CMS Plugin | 2.0.2 |
| n/a | Headless CMS Plugin | 2.0.3 |
| n/a | Headless CMS Plugin | 2.0.4 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
