---
id: "CVE-2026-121509"
kind: "vulnerability"
aliases: ["CVE-2026-121509"]
title: "WordPress Headless CMS Plugin: REST API leaks post data to remote callers"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["headless-cms", "package", "rest-api", "wordpress"]
not_affected_if: ["plugin-above-2.0.4", "plugin-not-installed"]
published_at: "2026-11-03T21:17:37+00:00"
first_seen_at: "2026-11-03T21:19:30+00:00"
updated_at: "2026-11-03T21:20:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121509", "first_seen_at": "2026-11-03T21:19:30+00:00"}]
---

# WordPress Headless CMS Plugin: REST API leaks post data to remote callers

The Headless CMS Plugin for WordPress, up to version 2.0.4, has a flaw in its REST API endpoint /wp-json/rae/v1/post where manipulating the post_id or post_slug argument discloses information. An attacker can trigger it remotely, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available.
- Look for the `/wp-json/rae/v1/post` route on the site, for example by requesting it and seeing whether it responds.

## Timeline

- 2026-11-03T21:19:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121509

## From the sources

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_