CVE-2025-11260

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11260", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-03T12:43:32.593Z", "datePublished": "2025-11-13T08:27:47.634Z", "dateUpdated": "2026-04-08T17:26:24.936Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:24.936Z"}, "affected": [{"vendor": "benmoody", "product": "WP Headless CMS Framework", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.15", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15. This is due to the plugin only checking for the existence of the Authorization header in a request when determining if the nonce protection should be bypassed. This makes it possible for unauthenticated attackers to access content they should not have access to."}], "title": "WP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a99806-cb8f-4c12-86ed-2cdbb45ba873?source=cve"}, {"url": "https://wordpress.org/plugins/wp-rest-headless/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-693 Protection Mechanism Failure", "cweId": "CWE-693", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-10-14T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-13T18:24:03.896836Z", "id": "CVE-2025-11260", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T18:24:21.022Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11260", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-13T18:24:03.896836Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T18:24:10.987Z"}}], "cna": {"title": "WP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism Bypass", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "benmoody", "product": "WP Headless CMS Framework", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.15"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-14T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a99806-cb8f-4c12-86ed-2cdbb45ba873?source=cve"}, {"url": "https://wordpress.org/plugins/wp-rest-headless/"}], "descriptions": [{"lang": "en", "value": "The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15. This is due to the plugin only checking for the existence of the Authorization header in a request when determining if the nonce protection should be bypassed. This makes it possible for unauthenticated attackers to access content they should not have access to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:24.936Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11260", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:26:24.936Z", "dateReserved": "2025-10-03T12:43:32.593Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-13T08:27:47.634Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Headless CMS Framework", "vendor": "benmoody", "versions": [{"lessThanOrEqual": "1.15", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15. This is due to the plugin only checking for the existence of the Authorization header in a request when determining if the nonce protection should be bypassed. This makes it possible for unauthenticated attackers to access content they should not have access to."}, {"lang": "es", "value": "El plugin WP Headless CMS Framework para WordPress es vulnerable a la elusi\u00f3n del mecanismo de protecci\u00f3n en todas las versiones hasta la 1.15, inclusive. Esto se debe a que el plugin solo verifica la existencia del encabezado de autorizaci\u00f3n en una solicitud al determinar si la protecci\u00f3n nonce debe ser eludida. Esto hace posible que atacantes no autenticados accedan a contenido al que no deber\u00edan tener acceso."}], "id": "CVE-2025-11260", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11260", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-13T18:24:03.896836Z", "version": "2.0.3"}}]}, "published": "2025-11-13T09:15:46.623", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wp-rest-headless/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a99806-cb8f-4c12-86ed-2cdbb45ba873?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-693"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:38:31.968811+00:00", "value": {"mitigation_remediation": ["Update the WP Headless CMS Framework plugin to a fixed release (version 1.16 or later).", "If an immediate update is not possible, enforce authentication or nonce validation on all plugin endpoints, for example by adding a custom permission callback in the REST API routes or disabling the plugin\u2019s nonce bypass feature.", "As a temporary measure, block unauthenticated requests to the plugin\u2019s REST endpoints using server\u2011side rules such as .htaccess redirects or firewall filters."], "summary": {"action": "Patch", "impact": "Data Disclosure"}, "threat_synthesis": {"affected_systems": "BenMoody's WP Headless CMS Framework up to and including version 1.15. Any installation of the plugin in these versions is affected.", "description_and_impact": "The WP Headless CMS Framework plugin contains a protection mechanism bypass that allows an unauthenticated attacker to retrieve content that should be protected. The flaw arises because the plugin only checks for the existence of an Authorization header when deciding whether to skip nonce validation, enabling nonce bypass. This constitutes a CWE\u2011693 weakness, permitting attackers to gain information that must remain confidential.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 5.3 and an EPSS of less than 1%, indicating a moderate severity but a low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog. Attackers can exploit it by sending a crafted HTTP request that includes an Authorization header to bypass nonce checks, thereby accessing protected content without authenticating."}}}}, "created": "2025-11-13T15:49:53.865910+00:00", "updated": "2026-04-21T01:45:24.441200+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}