CVE-2026-39520
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The weDocs plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
Unauthorized users can access functions or data that should be protected, potentially leading to security breaches.
Recommendation
Update the weDocs plugin to version 2.1.19 or later.
Other vulnerabilities in weDocs
See all- CVE-2026-12734Medium
The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'connectorWidth' block attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute when a user visits an affected page.
- CVE-2026-12731Medium
The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'sectionTitleTag' and 'articleTitleTag' block attributes. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute whenever a user visits an injected page.
- CVE-2026-12729Medium
The weDocs plugin for WordPress up to version 2.3.0 has a missing authorization vulnerability in the do_migration() function. Authenticated attackers with Subscriber-level access can trigger a data migration from BetterDocs to weDocs, creating and modifying 'docs' custom post type entries and deactivating BetterDocs plugins.
Original NVD description (English source)
Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through <= 2.1.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS