The WP Headless CMS Framework plugin contains a protection mechanism bypass that allows an unauthenticated attacker to retrieve content that should be protected. The flaw arises because the plugin only checks for the existence of an Authorization header when deciding whether to skip nonce validation, enabling nonce bypass. This constitutes a CWE‑693 weakness, permitting attackers to gain information that must remain confidential.

BenMoody's WP Headless CMS Framework up to and including version 1.15. Any installation of the plugin in these versions is affected.

The vulnerability carries a CVSS score of 5.3 and an EPSS of less than 1%, indicating a moderate severity but a low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog. Attackers can exploit it by sending a crafted HTTP request that includes an Authorization header to bypass nonce checks, thereby accessing protected content without authenticating.