Live › vulnerability › CVE-2026-121509
The Headless CMS Plugin for WordPress, up to version 2.0.4, has a flaw in its REST API endpoint /wp-json/rae/v1/post where manipulating the post_id or post_slug argument discloses information. An attacker can trigger it remotely, and a public exploit has been released.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Sites running the Headless CMS Plugin for WordPress at version 2.0.4 or earlier that expose the REST API route /wp-json/rae/v1/post to the internet. The sources do not say whether the flaw depends on a specific configuration or whether authentication is required. The vendor did not respond to the disclosure, so no fixed version is known.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version if WP-CLI is available./wp-json/rae/v1/post route on the site, for example by requesting it and seeing whether it responds.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121509")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.