CVE-2026-39520
Missing Authorization in weDevs weDocs ≤ 2.1.18 Enables Unauthorized Access
Publication date: 2026-04-08
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| we_devs | wedocs | to 2.1.18 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the weDocs plugin involves Broken Access Control, allowing unauthenticated users to perform actions requiring higher privileges. Such unauthorized access can lead to exposure or manipulation of sensitive data, which may impact compliance with standards like GDPR or HIPAA that mandate strict access controls and protection of personal or health information.
Although the CVE description and resources do not explicitly mention compliance impacts, missing authorization and broken access control are generally considered risks that can lead to violations of data protection regulations if exploited.
Therefore, organizations using affected versions of the plugin should update promptly to mitigate risks that could affect their regulatory compliance posture.
Can you explain this vulnerability to me?
CVE-2026-39520 is a Broken Access Control vulnerability in the WordPress weDocs Plugin versions up to and including 2.1.18. It occurs due to missing authorization, authentication, or nonce token checks in certain plugin functions, allowing unauthenticated users to perform actions that normally require higher privileges.
This means that attackers do not need to log in or have any special permissions to exploit the vulnerability, potentially enabling them to manipulate or access restricted parts of the plugin.
How can this vulnerability impact me? :
The vulnerability allows unauthenticated attackers to perform privileged actions within the weDocs plugin, which can lead to unauthorized access or modification of content or settings.
Although the CVSS severity score is 5.3, indicating a low priority threat with limited impact, it has been actively exploited in mass campaigns targeting many websites regardless of their popularity.
If exploited, this could compromise the integrity and security of your website's documentation managed by the plugin, potentially leading to data manipulation or unauthorized disclosure.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability in the WordPress weDocs Plugin up to version 2.1.18 allows unauthenticated users to perform actions requiring higher privileges due to missing authorization checks.
Detection typically involves checking the plugin version installed on your WordPress site to see if it is version 2.1.18 or earlier, as these are affected.
Since the vulnerability requires no prior authentication, monitoring for unusual or unauthorized access attempts to plugin functions could help detect exploitation attempts.
Specific commands are not provided in the available resources, but you can use WordPress CLI commands to check the installed plugin version, for example:
- wp plugin list --status=active
- wp plugin get wedocs --field=version
Additionally, reviewing web server logs for suspicious requests targeting the weDocs plugin endpoints may help identify exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to update the weDocs plugin to version 2.2.1 or later, where the vulnerability has been fixed.
Users are strongly advised to apply this update as soon as possible to prevent exploitation, as the vulnerability can be exploited without authentication.
If automatic updates are available through Patchstack or your WordPress management system, enabling them can facilitate rapid protection.
Additionally, monitoring and restricting access to plugin endpoints and implementing web application firewall (WAF) rules to block suspicious requests targeting the vulnerable plugin functions can help reduce risk.