CVE-2025-11260: WP Headless CMS Auth Bypass Vulnerability

CVE-2025-11260 Overview

CVE-2025-11260 affects the WP Headless CMS Framework plugin for WordPress in all versions up to and including 1.15. The plugin implements a flawed nonce protection check that bypasses validation whenever an Authorization header is present in the request. Unauthenticated attackers can send crafted HTTP requests with any Authorization header value to bypass the intended protection mechanism. This allows access to content that should require authentication. The flaw is categorized under CWE-693: Protection Mechanism Failure and is exploitable remotely over the network without user interaction.

Critical Impact
Unauthenticated remote attackers can bypass nonce protection and access restricted content through the plugin's REST API endpoints.

Affected Products

WP Headless CMS Framework plugin for WordPress
All versions up to and including 1.15
WordPress sites with the wp-rest-headless plugin installed and active

Discovery Timeline

2025-11-13 - CVE-2025-11260 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11260

Vulnerability Analysis

The WP Headless CMS Framework plugin exposes WordPress content through REST API endpoints for use by decoupled front-end applications. To support authenticated API clients, the plugin bypasses standard WordPress nonce verification when requests originate from token-based clients. The plugin implements this bypass by checking only for the presence of an Authorization header, without validating its content or verifying the token.

An unauthenticated attacker can add an arbitrary Authorization header to any HTTP request. The plugin treats the request as authenticated for the purpose of skipping nonce checks, granting access to endpoints and content that should require valid credentials. This is classified as a protection mechanism failure under CWE-693.

Root Cause

The root cause is an incomplete authentication gate. The plugin conflates header presence with authentication state. Because the Authorization header value is never validated before the nonce check is skipped, the protection is trivially defeated. Any string, including an empty value, satisfies the check.

Attack Vector

The attack requires only network access to the target WordPress site. An attacker sends an HTTP request to a protected plugin endpoint and includes an Authorization header with any value. The plugin skips nonce validation and processes the request, returning data that would otherwise be blocked. No credentials, no user interaction, and no prior access are required.

See the Wordfence Vulnerability Report for further technical detail.

Detection Methods for CVE-2025-11260

Indicators of Compromise

HTTP requests to /wp-json/ endpoints exposed by the WP Headless CMS Framework plugin containing an Authorization header from unauthenticated sources.
Unusual volume of REST API responses returning content that should be gated behind authentication.
Access log entries showing Authorization headers with malformed, empty, or non-standard token formats.

Detection Strategies

Inspect web server and WordPress access logs for REST API requests to plugin endpoints that include an Authorization header but originate from IPs without a valid authenticated session.
Deploy web application firewall (WAF) rules that flag requests to wp-rest-headless endpoints when the Authorization header value does not match expected token formats.
Correlate REST API access patterns against known good client behavior to identify anomalous consumers.

Monitoring Recommendations

Enable verbose logging on WordPress REST API endpoints exposed by the plugin.
Forward WordPress and web server logs to a centralized log platform for retention and analysis.
Set alerts on spikes in successful responses from plugin endpoints originating from a single IP or user agent.

How to Mitigate CVE-2025-11260

Immediate Actions Required

Update the WP Headless CMS Framework plugin to a version later than 1.15 once the vendor publishes a fix.
Audit REST API access logs for suspicious Authorization header usage since the plugin was installed.
Restrict access to plugin REST endpoints at the web server or WAF layer until a patched version is deployed.

Patch Information

At the time of publication, all versions up to and including 1.15 are affected. Administrators should monitor the official plugin page on WordPress.org for a patched release and apply the update as soon as it becomes available. Review the Wordfence Vulnerability Report for advisory updates.

Workarounds

Disable or uninstall the WP Headless CMS Framework plugin if the headless functionality is not required.
Add WAF or reverse proxy rules that strip or validate the Authorization header before requests reach WordPress.
Restrict access to /wp-json/ plugin endpoints by IP allowlist where headless clients are known and static.

bash

# Example nginx rule to block unauthenticated Authorization headers on plugin endpoints
location ~ ^/wp-json/headless {
    if ($http_authorization !~ "^Bearer [A-Za-z0-9._-]+$") {
        return 403;
    }
}