CVE-2025-11260

The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15. This is due to the plugin only checking for the existence of the Authorization header in a request when determining if the nonce protection should be bypassed. This makes it possible for unauthenticated attackers to access content they should not have access to.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wordpress.org/plugins/wp-rest-headless/
https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a99806-cb8f-4c12-86ed-2cdbb45ba873?source=cve

Configurations

No configuration.

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El plugin WP Headless CMS Framework para WordPress es vulnerable a la elusión del mecanismo de protección en todas las versiones hasta la 1.15, inclusive. Esto se debe a que el plugin solo verifica la existencia del encabezado de autorización en una solicitud al determinar si la protección nonce debe ser eludida. Esto hace posible que atacantes no autenticados accedan a contenido al que no deberían tener acceso.

Information

Published : 2025-11-13 09:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-11260

Mitre link : CVE-2025-11260

CVE.ORG link : CVE-2025-11260

JSON object : View

Products Affected

No product.

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-11260", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11260", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-13T18:24:03.896836Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "benmoody", "product": "WP Headless CMS Framework", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.15"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-13T09:15:46.623", "references": [{"url": "https://wordpress.org/plugins/wp-rest-headless/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a99806-cb8f-4c12-86ed-2cdbb45ba873?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15. This is due to the plugin only checking for the existence of the Authorization header in a request when determining if the nonce protection should be bypassed. This makes it possible for unauthenticated attackers to access content they should not have access to."}, {"lang": "es", "value": "El plugin WP Headless CMS Framework para WordPress es vulnerable a la elusi\u00f3n del mecanismo de protecci\u00f3n en todas las versiones hasta la 1.15, inclusive. Esto se debe a que el plugin solo verifica la existencia del encabezado de autorizaci\u00f3n en una solicitud al determinar si la protecci\u00f3n nonce debe ser eludida. Esto hace posible que atacantes no autenticados accedan a contenido al que no deber\u00edan tener acceso."}], "lastModified": "2026-10-07T21:10:00.200", "sourceIdentifier": "security@wordfence.com"}