CVE-2026-12729
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The weDocs plugin for WordPress up to version 2.3.0 has a missing authorization vulnerability in the do_migration() function. Authenticated attackers with Subscriber-level access can trigger a data migration from BetterDocs to weDocs, creating and modifying 'docs' custom post type entries and deactivating BetterDocs plugins.
Risk Assessment
The organization faces unauthorized modification of documentation content and plugin deactivation, potentially leading to data loss and service disruption.
Recommendation
Immediately update the weDocs plugin to the latest version and check for any unauthorized data migrations.
Other vulnerabilities in weDocs
See all- CVE-2026-12734Medium
The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'connectorWidth' block attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute when a user visits an affected page.
- CVE-2026-12731Medium
The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'sectionTitleTag' and 'articleTitleTag' block attributes. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute whenever a user visits an injected page.
- CVE-2026-39520Medium
The weDocs plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.3.0. This is due to a missing capability check on the do_migration() function registered as the wedocs_migrate_betterdocs_to_wedocs AJAX action, which performs no nonce verification via check_ajax_referer() and no capability check via current_user_can() before executing sensitive operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full BetterDocs-to-weDocs data migration, creating and modifying 'docs' custom post type entries with attacker-controlled titles, updating site options, and deactivating the BetterDocs and BetterDocs Pro plugins via deactivate_plugins().