PT-2026-55440 · Wedevs · Wedocs: Ai Powered Knowledge Base

Prism · Published 2026-07-03 · Updated 2026-07-03 · CVE-2026-12729

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.3.0. This is due to a missing capability check on the do migration() function registered as the wedocs migrate betterdocs to wedocs AJAX action, which performs no nonce verification via check ajax referer() and no capability check via current user can() before executing sensitive operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full BetterDocs-to-weDocs data migration, creating and modifying 'docs' custom post type entries with attacker-controlled titles, updating site options, and deactivating the BetterDocs and BetterDocs Pro plugins via deactivate plugins().

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-12729

Affected Products

Wedocs: Ai Powered Knowledge Base

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-12729 · Security Note
• https://plugins.trac.wordpress.org/browser/wedocs/tags/2.3.0/includes/Admin/Migrate.php#L183 · Note
• https://plugins.trac.wordpress.org/browser/wedocs/tags/2.3.0/includes/Ajax.php#L39 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3589430%40wedocs&new=3589430%40wedocs&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/228d63a5-5053-4692-9801-4860325da153?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wedocs/tags/2.3.0/includes/Admin/Migrate.php#L206 · Note
• https://plugins.trac.wordpress.org/browser/wedocs/tags/2.3.0/includes/Admin/Migrate.php#L56 · Note