{
 "id": "WPSEC-2026-2538",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2538/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2538/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2538/index.md",
 "title": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Unauthenticated Sensitive Information Exposure via AI Summary REST Endpoint",
 "description": "The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure via the AI summary REST routes in all versions up to, and including, 2.6.1. This is because the route that reads a stored summary had no permission check ('__return_true'), and the summary generation check did not take post passwords into account. This makes it possible for unauthenticated attackers to read stored AI summaries of draft, private and password-protected docs, and to generate summaries of password-protected docs, exposing content taken from the doc body.",
 "plugin": {
  "slug": "wedocs",
  "name": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot",
  "full_name": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot",
  "wordpress_org": "https://wordpress.org/plugins/wedocs/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wedocs/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wedocs"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.2.0",
    "from_inclusive": true,
    "to": "2.6.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.2.0 before 2.6.2"
  ]
 },
 "introduced_in": "2.2.0",
 "fixed_in": "2.6.2",
 "remediation": "Update to 2.6.2 or later.",
 "fix_released": "2026-11-04T05:28:09+00:00",
 "published": "2026-11-05T05:42:12+00:00",
 "updated": "2026-11-04T14:28:25.663917+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2538/",
  "https://plugins.svn.wordpress.org/wedocs/tags/2.6.2/",
  "https://wordpress.org/plugins/wedocs/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wedocs",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-05"
 }
}