# WP Document Revisions <= 5.8.1 - Authenticated (Contributor+) Missing Authorization to Document Attachment Reversion via REST API Revisions Routes

- **ID:** WPSEC-2026-1872
- **Plugin:** WP Document Revisions (`wp-document-revisions`), https://wordpress.org/plugins/wp-document-revisions/
- **Affected versions:** all versions before 5.8.2
- **Fixed in:** 5.8.2 (Update to 5.8.2 or later.)
- **Severity:** Low 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-document-revisions
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1872/

## Description

The WP Document Revisions plugin for WordPress is vulnerable to Missing Authorization via the REST API document revisions and autosaves routes in all versions up to, and including, 5.8.1, due to the populate_document_meta() dispatch handler filling in the _document_attachment_id meta for the route's id without checking that the id is a document. On the nested revisions and autosaves routes the id is a revision, and its meta is written to the revision's parent document, which the route's permission check never covered. This makes it possible for authenticated attackers, with Contributor-level access and above, to point another user's document back at one of its older files, which the document then serves the next time it is saved. Exploitation requires documents to be enabled in the REST API with the document_show_in_rest filter, which is off by default.

## References

- https://wpsec.com/vuln/WPSEC-2026-1872/
- https://plugins.svn.wordpress.org/wp-document-revisions/tags/5.8.2/
- https://wordpress.org/plugins/wp-document-revisions/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1872/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.