EUVD-2026-41468
GHSA-8rwq-pvxh-vj87
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible AJAX with subscriber auth (AV:N/PR:L); A:L added over provided score because deactivating installed plugins is a concrete availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.3.0. This is due to a missing capability check on the do_migration() function registered as the wedocs_migrate_betterdocs_to_wedocs AJAX action, which performs no nonce verification via check_ajax_referer() and no capability check via current_user_can() before executing sensitive operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full BetterDocs-to-weDocs data migration, creating and modifying 'docs' custom post type entries with attacker-controlled titles, updating site options, and deactivating the BetterDocs and BetterDocs Pro plugins via deactivate_plugins().
AnalysisAI
Missing authorization on the BetterDocs-to-weDocs migration AJAX endpoint in the weDocs WordPress plugin (versions up to and including 2.3.0) allows any authenticated subscriber-level user to trigger a full data migration, manipulate documentation content, alter site options, and forcibly deactivate installed BetterDocs and BetterDocs Pro plugins. The vulnerable do_migration() function registered under the wedocs_migrate_betterdocs_to_wedocs AJAX action performs neither a nonce check via check_ajax_referer() nor a privilege check via current_user_can(), exposing sensitive administrative operations to the lowest authenticated user tier. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
The affected component is the weDocs WordPress plugin by weDevs (CPE: cpe:2.3:a:wedevs:wedocs), a knowledge-base and documentation tool that includes an AI chatbot feature. The vulnerability resides in the do_migration() method within includes/Admin/Migrate.php (confirmed at lines 56, 183, and 206 of tag 2.3.0), registered as a WordPress AJAX action in includes/Ajax.php (line 39). WordPress AJAX actions registered with wp_ajax_{action} are accessible to any logged-in user unless explicitly guarded by capability checks (current_user_can()) and CSRF nonce verification (check_ajax_referer()). Neither guard is present here, a textbook instance of CWE-862 (Missing Authorization). The migration logic creates and modifies WordPress custom post type entries of type 'docs', updates wp_options rows, and invokes deactivate_plugins() against BetterDocs and BetterDocs Pro - operations that ordinarily require administrator-level capabilities. The root cause is the failure to enforce the WordPress capability model on a sensitive administrative pathway exposed to all authenticated users.
RemediationAI
Update the weDocs plugin to the version that includes SVN changeset 3589430 or later, which addresses the missing authorization on the migration AJAX action. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/228d63a5-5053-4692-9801-4860325da153 should be consulted for the exact patched release version, as the specific fixed version number was not independently confirmed from the available input data. As an interim compensating control, site administrators can disable new user registrations (Settings > General > Anyone can register) to prevent untrusted subscribers from obtaining authenticated access, noting that this does not protect sites with existing untrusted subscriber accounts. Alternatively, a WAF rule blocking POST requests to wp-admin/admin-ajax.php with action=wedocs_migrate_betterdocs_to_wedocs from non-administrator sessions will block exploitation without affecting normal site functionality. Removing the BetterDocs integration if it is not in use eliminates one avenue of impact but does not close the authorization gap itself.
Stored Cross-Site Scripting in the weDocs WordPress plugin (versions through 2.3.0) allows authenticated contributors to
Stored Cross-Site Scripting in the weDocs WordPress plugin (all versions through 2.3.0) allows authenticated contributor
Missing authorization in weDevs weDocs WordPress plugin through version 2.1.18 allows unauthenticated remote attackers t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today