PT-2025-46791 · WordPress · Wp Headless Cms Framework

Published 2025-11-13 · Updated 2025-11-13 · CVE-2025-11260

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Headless CMS Framework versions up to and including 1.15

Description The WP Headless CMS Framework plugin for WordPress has a flaw where its protection mechanisms can be bypassed. The plugin only verifies the presence of the Authorization header to determine whether to bypass nonce protection. This allows unauthenticated attackers to access content they are not authorized to view.

Recommendations Update WP Headless CMS Framework to a version later than 1.15.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2025-11260

Affected Products

Wp Headless Cms Framework

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11260 · Security Note
• https://t.me/cveNotify/142633 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d6a99806-cb8f-4c12-86ed-2cdbb45ba873?source=cve · Note
• https://twitter.com/CVEnew/status/1988891934841266255 · Twitter Post
• https://wordpress.org/plugins/wp-rest-headless · Note
• https://twitter.com/VulmonFeeds/status/1988987287493910535 · Twitter Post