Ticket #47962: 47962.patch

src/js/_enqueues/wp/api-request.js

@@ -69 +69 @@
                         }
                 }
 
-                if ( addNonceHeader ) {
+                // Force the addiction of the nonce header for self requests only.
+                if ( addNonceHeader && -1 !== url.indexOf( wpApiSettings.root ) ) {
                         // Do not mutate the original headers object, if any.
                         headers = $.extend( {
                                 'X-WP-Nonce': wpApiSettings.nonce