{
 "id": "WPSEC-2026-2540",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2540/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2540/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2540/index.md",
 "title": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Editor+) Missing Authorization to Arbitrary Post Deletion and Modification",
 "description": "The weDocs plugin for WordPress is vulnerable to unauthorized modification and loss of data in all versions up to, and including, 2.6.1. This is because the docs REST routes for deleting docs, sorting docs and changing doc status check only the general 'edit_docs' capability, with no per-post capability check and no post type check, and accept any status value. This makes it possible for authenticated attackers with editor-level access and above to trash posts of any post type, permanently delete every child post (including attachments) of a targeted post, convert arbitrary posts to the docs post type, and change the status of arbitrary posts.",
 "plugin": {
  "slug": "wedocs",
  "name": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot",
  "full_name": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot",
  "wordpress_org": "https://wordpress.org/plugins/wedocs/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wedocs/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wedocs"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.1.0",
    "from_inclusive": true,
    "to": "2.6.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.1.0 before 2.6.2"
  ]
 },
 "introduced_in": "2.1.0",
 "fixed_in": "2.6.2",
 "remediation": "Update to 2.6.2 or later.",
 "fix_released": "2026-11-04T05:28:09+00:00",
 "published": "2026-11-05T05:42:12+00:00",
 "updated": "2026-11-04T14:28:25.663917+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2540/",
  "https://plugins.svn.wordpress.org/wedocs/tags/2.6.2/",
  "https://wordpress.org/plugins/wedocs/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wedocs",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}