Description
WordPress Plugin WP REST API (WP API) is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to serve up arbitrary Flash SWF files from the API, allowing these Flash files to bypass browser cross-origin domain policies. WordPress Plugin WP REST API (WP API) version 1.1 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.1.1 or latest
References
Related Vulnerabilities
WordPress Plugin Share Drafts Publicly Information Disclosure (1.1.4)
Citrix NetScaler Memory Disclosure 'Citrix Bleed 2' (CVE-2025-5777)
GlassFish CVE-2016-5519 Vulnerability (CVE-2016-5519)
Atlassian Confluence Uncontrolled Search Path Element Vulnerability (CVE-2019-20406)
Jboss EAP Improper Restriction of Excessive Authentication Attempts Vulnerability (CVE-2025-23368)