Vulnerabilities / weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot / WPSEC-2026-2536
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Unauthenticated Sensitive Information Exposure via Docs Search AJAX Action
Medium 5.3
CWE-200Fixed in 2.6.2
- ID
- WPSEC-2026-2536
- Plugin
- weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot (wedocs)
- Affected
- from 2.1.0 before 2.6.2
- Remediation
- Update to 2.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot on WPSec AttackSurface
- Fix released
- Published
Description
The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'wedocs_get_docs' AJAX action in all versions up to, and including, 2.6.1. This is because the docs search handler returns full post objects, including the post_password and post_content fields, to any visitor, and the nonce it checks is printed on the front end. This makes it possible for unauthenticated attackers to read the content and passwords of password-protected docs.
References
- https://wpsec.com/vuln/WPSEC-2026-2536/
- https://plugins.svn.wordpress.org/wedocs/tags/2.6.2/
- https://wordpress.org/plugins/wedocs/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS