{"id":"CVE-2026-121760","kind":"vulnerability","aliases":["CVE-2026-121760"],"related":[],"title":"weDocs WordPress plugin: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.","summary":"weDocs, a WordPress documentation plugin by weDevs, lacks an authorization check on some functionality, so access control is not enforced as intended. The sources do not say what data or actions an attacker gains beyond bypassing access controls.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wedocs","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed weDocs plugin version in the WordPress admin under Plugins; the sources say versions through `2.6.1` are affected.","fix":"- weDocs: move to a version later than `2.6.1`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-09T10:17:07+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:10+00:00","updated_at":"2026-11-09T10:26:10+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T10:26:10Z","model":"claude-haiku-5-5","output":{"fix":"- weDocs: move to a version later than `2.6.1`; the sources do not name the exact fixed version.","reach":"internet","title":"weDocs WordPress plugin: missing authorization lets users bypass access controls","impact":"medium","summary":"weDocs, a WordPress documentation plugin by weDevs, lacks an authorization check on some functionality, so access control is not enforced as intended. The sources do not say what data or actions an attacker gains beyond bypassing access controls.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wedocs"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Unauthorized users may reach documentation access controls they should not","analyst_note":"Check the NVD entry and the weDevs advisory for the exact fixed version, the affected endpoint, and whether authentication is required.","how_to_check":"- Check the installed weDocs plugin version in the WordPress admin under Plugins; the sources say versions through `2.6.1` are affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the weDocs WordPress plugin version 2.6.1 or earlier, according to the NVD description. The sources do not say which configurations or roles are needed to reach the flaw.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00072,"input_tokens":4534,"output_tokens":534,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121760':13A,16A '-2026':12A,15A '2.6.1':79C 'access':9A,35B,56B,69C 'action':50B 'affect':74C 'allow':65C 'attack':52B 'author':5A,29B,59C 'beyond':54B 'bypass':8A,55B 'check':30B 'configur':68C 'control':10A,36B,57B,70C 'cve':11A,14A 'data':48B 'document':23B 'enforc':39B 'exploit':66C 'function':33B 'gain':53B 'incorrect':67C 'intend':41B 'issu':73C 'lack':27B 'let':6A 'levels.this':72C 'miss':4A,58C 'n/a':77C 'packag':17B 'plugin':3A,24B 'say':46B 'secur':71C 'sourc':43B 'user':7A 'vulner':60C 'wedev':26B,62C 'wedoc':1A,18B,20B,63C,64C,75C 'wordpress':2A,19B,22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the weDocs WordPress plugin version 2.6.1 or earlier, according to the NVD description. The sources do not say which configurations or roles are needed to reach the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","wedocs","wordpress"],"campaign_type":null,"search_a":"'-121760':13A,16A '-2026':12A,15A 'access':9A 'author':5A 'bypass':8A 'control':10A 'cve':11A,14A 'let':6A 'miss':4A 'plugin':3A 'user':7A 'wedoc':1A 'wordpress':2A","search_b":"'access':35B,56B 'action':50B 'attack':52B 'author':29B 'beyond':54B 'bypass':55B 'check':30B 'control':36B,57B 'data':48B 'document':23B 'enforc':39B 'function':33B 'gain':53B 'intend':41B 'lack':27B 'packag':17B 'plugin':24B 'say':46B 'sourc':43B 'wedev':26B 'wedoc':18B,20B 'wordpress':19B,22B","search_c":"'2.6.1':79C 'access':69C 'affect':74C 'allow':65C 'author':59C 'configur':68C 'control':70C 'exploit':66C 'incorrect':67C 'issu':73C 'levels.this':72C 'miss':58C 'n/a':77C 'secur':71C 'vulner':60C 'wedev':62C 'wedoc':63C,64C,75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121760","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121760","severity":null,"published_at":"2026-11-09T10:17:07+00:00","modified_at":"2026-11-09T10:17:07+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}