Threats tagged 'ghsa-qp6v-4jg2-qc2c'

A security flaw in the Headless CMS Plugin for WordPress up to version 2.0.4 allows remote attackers to cause information disclosure via manipulation of the post_id or post_slug parameters in the REST API endpoint /wp-json/rae/v1/post. The vulnerability affects the get_required_post_data function. Public exploit code is available, and the vendor has not responded to the disclosure.