CVE-2026-121509

The Headless CMS Plugin (up to version 2.0.4 ) for WordPress contains an information disclosure vulnerability in the REST API component. Specifically, the get_required_post_data function within the /wp-json/rae/v1/post endpoint is susceptible to manipulation of the post_id or post_slug arguments....