# weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.2 - Unauthenticated Sensitive Information Exposure via REST Sub-Routes, Search, and Contributors Endpoints

- **ID:** WPSEC-2026-2579
- **Plugin:** weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot (`wedocs`), https://wordpress.org/plugins/wedocs/
- **Affected versions:** from 1.5 before 2.6.3
- **Fixed in:** 2.6.3 (Update to 2.6.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wedocs
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2579/

## Description

The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure via the /wp/v2/docs/{id}/parents and /wp/v2/docs/{id}/ai-summary REST routes, the docs REST search, the Quick Search AJAX action and the contributors REST endpoint in all versions up to, and including, 2.6.2. This is due to the plugin checking only the status of the requested section or article, not of the doc above it. The parents route also returns the top-level doc with its rendered content even when that doc is a draft or private. This makes it possible for unauthenticated attackers to read the title and content of draft and private docs, and the sections, articles and related data under them, by requesting a published section or article that belongs to them.

## References

- https://wpsec.com/vuln/WPSEC-2026-2579/
- https://plugins.svn.wordpress.org/wedocs/tags/2.6.3/
- https://wordpress.org/plugins/wedocs/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2579/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.