The weDocs plugin for WordPress contains an authorization flaw that allows any authenticated user with a Subscriber role or higher to modify the plugin’s global settings. This happens because the create_item_permissions_check function in the Settings API does not verify that the caller has sufficient privileges. If exploited, an attacker can alter configuration values that affect the entire knowledge base, potentially redirecting content or disabling documentation features.

WordPress sites that use the weDocs plugin version 2.1.14 or earlier are vulnerable. The plugin, sold by wedevs as an AI‑powered knowledge base and documentation platform, must be examined on all installations running these legacy releases.

The vulnerability is scored with a CVSS of 5.4, indicating moderate severity. The EPSS score of less than 1% suggests a low probability of current exploitation, and the vulnerability is not present in the CISA KEV catalog. An attacker must first authenticate to the WordPress site with a Subscriber or greater role; no additional conditions such as remote network exposure are required. Once authenticated, the attacker can call the Settings API endpoint to change any configuration parameter.