---
id: "CVE-2026-121760"
page: "https://infrastack.ai/live/CVE-2026-121760"
kind: "vulnerability"
aliases: ["CVE-2026-121760"]
title: "weDocs WordPress plugin: missing authorization lets users bypass access controls"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wedocs", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T10:17:07+00:00"
first_seen_at: "2026-11-09T10:25:48+00:00"
updated_at: "2026-11-09T10:26:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121760", "first_seen_at": "2026-11-09T10:25:48+00:00"}]
exploit_sources: []
---

# weDocs WordPress plugin: missing authorization lets users bypass access controls

Link for people: https://infrastack.ai/live/CVE-2026-121760 (this .md is for agents)

weDocs, a WordPress documentation plugin by weDevs, lacks an authorization check on some functionality, so access control is not enforced as intended. The sources do not say what data or actions an attacker gains beyond bypassing access controls.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed weDocs plugin version in the WordPress admin under Plugins; the sources say versions through `2.6.1` are affected.

## Fix

- weDocs: move to a version later than `2.6.1`; the sources do not name the exact fixed version.

## Timeline

- 2026-11-09T10:25:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121760

## From the sources

Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_