CVE-2025-12505
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the create_item_permissions_check function. This allows authenticated attackers with Subscriber-level access and above to modify global plugin settings.
Risk Assessment
An attacker with low privileges (Subscriber) can modify global plugin settings, potentially leading to site malfunction, data exposure, or further privilege escalation.
Recommendation
Update the weDocs plugin to a version newer than 2.1.14 or remove it if unused. Additionally, consider restricting the ability to register new Subscriber accounts if not needed.
Other vulnerabilities in weDocs
See all- CVE-2026-12734Medium
The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'connectorWidth' block attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute when a user visits an affected page.
- CVE-2026-12731Medium
The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'sectionTitleTag' and 'articleTitleTag' block attributes. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute whenever a user visits an injected page.
- CVE-2026-12729Medium
The weDocs plugin for WordPress up to version 2.3.0 has a missing authorization vulnerability in the do_migration() function. Authenticated attackers with Subscriber-level access can trigger a data migration from BetterDocs to weDocs, creating and modifying 'docs' custom post type entries and deactivating BetterDocs plugins.
- CVE-2026-39520Medium
The weDocs plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the create_item_permissions_check function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global plugin settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS