CVE-2026-121509

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-121509 Headless CMS Plugin REST API post get_required_post_data information disclosure

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

EUVD-2026-116486

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-121509

The Headless CMS Plugin (up to version 2.0.4 ) for WordPress contains an information disclosure vulnerability in the REST API component. Specifically, the get_required_post_data function within the /wp-json/rae/v1/post endpoint is susceptible to manipulation of the post_id or post_slug arguments....

WordPress plugin Headless CMS has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...