{"id":"CVE-2026-121767","kind":"vulnerability","aliases":["CVE-2026-121767"],"related":[],"title":"weDocs WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.","summary":"weDocs, a WordPress documentation plugin by weDevs, has a missing authorization check in versions through 2.6.1. A user without the right permissions may be able to perform actions that should be restricted.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wedocs","wordpress"],"not_affected_if":["plugin-not-installed","version-above-2.6.1"],"how_to_check":"- Check the installed weDocs plugin version in the WordPress admin Plugins page or the `wedocs` plugin header\n- Compare the installed version against `2.6.1`","fix":"- weDocs: the sources do not name a fixed version; move to a release later than `2.6.1` once the vendor publishes one","status":"open","published_at":"2026-11-07T09:17:13+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","triaged_at":"2026-11-07T09:48:03+00:00","updated_at":"2026-11-07T09:48:03+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T09:48:03Z","model":"claude-haiku-5-5","output":{"fix":"- weDocs: the sources do not name a fixed version; move to a release later than `2.6.1` once the vendor publishes one","reach":"internet","title":"weDocs WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"weDocs, a WordPress documentation plugin by weDevs, has a missing authorization check in versions through 2.6.1. A user without the right permissions may be able to perform actions that should be restricted.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","weDocs","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users perform restricted documentation actions on the site","analyst_note":"Find the affected endpoint and the required privilege level in the NVD entry or the plugin changelog; confirm the fixed version.","how_to_check":"- Check the installed weDocs plugin version in the WordPress admin Plugins page or the `wedocs` plugin header\n- Compare the installed version against `2.6.1`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-2.6.1"],"who_is_affected":"Sites running the weDocs plugin version 2.6.1 or earlier are in scope. The description does not say which actions are missing checks or whether anonymous users can reach them, so the exposure depends on the plugin's permission model, which the sources do not detail.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4207,"output_tokens":547,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121767':12A,15A '-2026':11A,14A '2.6.1':37B,75C 'abl':46B 'access':8A,65C 'action':49B 'affect':70C 'allow':61C 'author':5A,32B,55C 'check':6A,33B 'configur':64C 'control':9A,66C 'cve':10A,13A 'document':25B 'exploit':62C 'expos':7A 'host':19B 'incorrect':63C 'issu':69C 'levels.this':68C 'may':44B 'miss':4A,31B,54C 'n/a':73C 'packag':16B 'perform':48B 'permiss':43B 'plugin':3A,26B 'restrict':53B 'right':42B 'secur':67C 'self':18B 'self-host':17B 'user':39B 'version':35B 'vulner':56C 'wedev':28B,58C 'wedoc':1A,20B,22B,59C,60C,71C 'without':40B 'wordpress':2A,21B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the weDocs plugin version 2.6.1 or earlier are in scope. The description does not say which actions are missing checks or whether anonymous users can reach them, so the exposure depends on the plugin's permission model, which the sources do not detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wedocs","wordpress"],"campaign_type":null,"search_a":"'-121767':12A,15A '-2026':11A,14A 'access':8A 'author':5A 'check':6A 'control':9A 'cve':10A,13A 'expos':7A 'miss':4A 'plugin':3A 'wedoc':1A 'wordpress':2A","search_b":"'2.6.1':37B 'abl':46B 'action':49B 'author':32B 'check':33B 'document':25B 'host':19B 'may':44B 'miss':31B 'packag':16B 'perform':48B 'permiss':43B 'plugin':26B 'restrict':53B 'right':42B 'self':18B 'self-host':17B 'user':39B 'version':35B 'wedev':28B 'wedoc':20B,22B 'without':40B 'wordpress':21B,24B","search_c":"'2.6.1':75C 'access':65C 'affect':70C 'allow':61C 'author':55C 'configur':64C 'control':66C 'exploit':62C 'incorrect':63C 'issu':69C 'levels.this':68C 'miss':54C 'n/a':73C 'secur':67C 'vulner':56C 'wedev':58C 'wedoc':59C,60C,71C","first_public_at":"2026-11-07T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121767","severity":null,"published_at":"2026-11-07T09:17:13+00:00","modified_at":"2026-11-07T09:17:13+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","fetched_at":"2026-11-07T09:46:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}