headless cms plugin vulnerabilities

Products

• headless cms plugin 1

Latest headless cms plugin CVEs

Newest publication first

1. CVE-2026-121509 Headless CMS Plugin REST API post get_required_post_data information disclosure

   Published 2026-11-03

   Medium·CVSS 6.9

   A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.