{
 "id": "WPSEC-2026-2579",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2579/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2579/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2579/index.md",
 "title": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.2 - Unauthenticated Sensitive Information Exposure via REST Sub-Routes, Search, and Contributors Endpoints",
 "description": "The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure via the /wp/v2/docs/{id}/parents and /wp/v2/docs/{id}/ai-summary REST routes, the docs REST search, the Quick Search AJAX action and the contributors REST endpoint in all versions up to, and including, 2.6.2. This is due to the plugin checking only the status of the requested section or article, not of the doc above it. The parents route also returns the top-level doc with its rendered content even when that doc is a draft or private. This makes it possible for unauthenticated attackers to read the title and content of draft and private docs, and the sections, articles and related data under them, by requesting a published section or article that belongs to them.",
 "plugin": {
  "slug": "wedocs",
  "name": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot",
  "full_name": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot",
  "wordpress_org": "https://wordpress.org/plugins/wedocs/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wedocs/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wedocs"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.5",
    "from_inclusive": true,
    "to": "2.6.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.5 before 2.6.3"
  ]
 },
 "introduced_in": "1.5",
 "fixed_in": "2.6.3",
 "remediation": "Update to 2.6.3 or later.",
 "fix_released": "2026-11-04T12:06:54+00:00",
 "published": "2026-11-05T12:51:17+00:00",
 "updated": "2026-11-05T10:27:37.075934+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2579/",
  "https://plugins.svn.wordpress.org/wedocs/tags/2.6.3/",
  "https://wordpress.org/plugins/wedocs/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wedocs",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}