CVE-2025-11260 is a protection mechanism failure (CWE-693) in the WP Headless CMS Framework WordPress plugin. The vulnerability arises because the plugin's logic for bypassing nonce protection relies solely on the presence of the Authorization header, which is insufficient to properly enforce access controls. This allows unauthenticated attackers to bypass nonce protections and access restricted content. The issue affects all plugin versions up to and including 1.15. The CVSS 3.1 base score is 5.3, reflecting a network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An unauthenticated attacker can bypass nonce protections and access content that should be protected by the WP Headless CMS Framework plugin. The impact is limited to confidentiality as the attacker can read restricted content but cannot modify data or cause availability issues. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the plugin or disabling it if possible to prevent unauthorized content access. Monitor vendor channels for updates or patches addressing this vulnerability.