{"id":"CVE-2026-121509","kind":"vulnerability","aliases":["CVE-2026-121509"],"related":[],"title":"WordPress Headless CMS Plugin: REST API leaks post data to remote callers","description":"A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Headless CMS Plugin for WordPress, up to version 2.0.4, has a flaw in its REST API endpoint /wp-json/rae/v1/post where manipulating the post_id or post_slug argument discloses information. An attacker can trigger it remotely, and a public exploit has been released.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["headless-cms","package","rest-api","wordpress"],"not_affected_if":["plugin-above-2.0.4","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available.\n- Look for the `/wp-json/rae/v1/post` route on the site, for example by requesting it and seeing whether it responds.","fix":null,"status":"open","published_at":"2026-11-03T21:17:37+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","triaged_at":"2026-11-03T21:20:44+00:00","updated_at":"2026-11-03T21:20:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T21:20:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Headless CMS Plugin: REST API leaks post data to remote callers","impact":"low","summary":"The Headless CMS Plugin for WordPress, up to version 2.0.4, has a flaw in its REST API endpoint /wp-json/rae/v1/post where manipulating the post_id or post_slug argument discloses information. An attacker can trigger it remotely, and a public exploit has been released.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","headless-cms","rest-api"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote callers read post data they should not see","analyst_note":"Check whether a fixed version or vendor response exists and whether authentication is needed; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121509 is the only source given.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available.\n- Look for the `/wp-json/rae/v1/post` route on the site, for example by requesting it and seeing whether it responds.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-2.0.4"],"who_is_affected":"Sites running the Headless CMS Plugin for WordPress at version 2.0.4 or earlier that expose the REST API route /wp-json/rae/v1/post to the internet. The sources do not say whether the flaw depends on a specific configuration or whether authentication is required. The vendor did not respond to the disclosure, so no fixed version is known.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000738,"input_tokens":4173,"output_tokens":642,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121509':15A,18A '-2026':14A,17A '/wp-json/rae/v1/post':45B,96C '2.0.4':36B,82C 'affect':86C 'api':6A,25B,43B,101C 'argument':54B,106C 'attack':58B,114C,132C 'caller':12A 'cms':3A,21B,29B,78C 'compon':99C 'contact':136C 'cve':13A,16A 'data':9A,92C 'disclos':55B 'disclosur':112C,140C 'discov':75C 'earli':137C 'endpoint':44B 'exploit':66B,120C 'file':95C 'flaw':39B,72C 'function':88C 'get':89C 'headless':2A,20B,28B,77C 'headless-cm':19B 'id':50B 'id/post_slug':108C 'inform':56B,111C 'launch':117C 'leak':7A 'manipul':47B,103C 'may':115C,128C 'packag':22B 'plugin':4A,30B,79C 'post':8A,49B,52B,91C,107C 'public':65B,126C 'releas':69B,123C 'remot':11A,62B,118C 'requir':90C 'respond':144C 'rest':5A,24B,42B,100C 'rest-api':23B 'result':109C 'secur':71C 'slug':53B 'trigger':60B 'use':130C 'vendor':134C 'version':35B 'way':147C 'wordpress':1A,26B,32B,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Headless CMS Plugin for WordPress at version 2.0.4 or earlier that expose the REST API route /wp-json/rae/v1/post to the internet. The sources do not say whether the flaw depends on a specific configuration or whether authentication is required. The vendor did not respond to the disclosure, so no fixed version is known.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["headlesscms","medium","package","restapi","wordpress"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121509","severity":null,"published_at":"2026-11-03T21:17:37+00:00","modified_at":"2026-11-03T21:17:37+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","fetched_at":"2026-11-03T21:19:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}