Headless CMS Plugin CVE-2026-121509

Exploitation requires only that the target WordPress site has Headless CMS Plugin version ≤2.0.4 installed and active, which exposes the /wp-json/rae/v1/post REST API route by default; no authentication, credentials, or user interaction are needed. By manipulating the post_id or post_slug argument handled by get_required_post_data, an attacker retrieves draft, private, and scheduled (future) post content. The principal limiting factor is deployment scope - the specific plugin must be installed - rather than any configuration prerequisite, since the vulnerable REST route is reachable in the plugin's default state. No fixed version is available because the vendor did not respond; updating/removal cannot currently be confirmed as a remedy.

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity access with no user interaction, and the input CVSS 4.0 vector explicitly contains PR:N, so exploitation is unauthenticated. However, impact is constrained to confidentiality only (VC:L, VI:N, VA:N) - it discloses non-public post content, not full system compromise, which is why the score lands at 6.9 (medium) rather than critical. The vuln.today decision label is 'this_month' and the SSVC exploitation sub-metric is E:P (proof-of-concept), consistent with a public PoC reference rather than confirmed mass exploitation. There is no CISA KEV listing and no EPSS score provided, so widespread active exploitation is not evidenced; a public PoC reference exists but it is not verified as working exploit code. The main risk driver is the trivial trigger (unauthenticated REST endpoint) against any site running the affected plugin, tempered by the limited, information-only impact and the small deployment footprint of this plugin.

An unauthenticated remote attacker sends requests to the /wp-json/rae/v1/post REST endpoint of a WordPress site running Headless CMS Plugin ≤2.0.4, varying the post_id or post_slug argument to retrieve draft, private, and scheduled (future) post content that should not be publicly visible. A public PoC reference exists (a Notion write-up); it is not verified as working exploit code, so weaponization effort is unknown. Because the attack is network-based, low-complexity, and needs no authentication or user interaction, enumeration of hidden content across many sites is straightforward.