CVE-2026-121509
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the
CVSS
5.3
Média
EPSS
0.4%
p32
KEV
—
Exploit Today
10
0-100
Publicado: 3 de nov. de 2026 · Última mod.: 3 de nov. de 2026 · CWE-200 · CWE-284
0.4%EPSS · 30 dias0.4%
2026-11-042026-11-05
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- app.notion.comhttps://app.notion.com/p/Unauthenticated-disclosure-of-draft-private-and-future-post-contentimranhsayed-headless-cms-2-0-4-3f384f1ea6a48057bb67ed0dd89f4157?source=copy_link
- vuldb.comhttps://vuldb.com/cve/CVE-2026-121509
- vuldb.comhttps://vuldb.com/submit/1019400
- vuldb.comhttps://vuldb.com/vuln/430285
- vuldb.comhttps://vuldb.com/vuln/430285/cti
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-351134.8 MÉD—
———HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.6hCVE-2026-351124.2 MÉD—
———HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security impact under certain conditions.6hCVE-2026-351114.8 MÉD—
———HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions.6hCVE-2026-351153.7 BAI—
———HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.7hCVE-2026-351143.7 BAI—
———HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses. This may cause content to be interpreted as an unintended type, potentially resulting in unintended behavior or security impact under certain conditions.7hCVE-2026-49939——
———In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.
This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.8h