The weDocs AI Powered Knowledge Base plugin for WordPress has a missing capability check that lets any authenticated user with Subscriber-level access edit or delete any documentation post. This flaw permits an attacker to alter or remove content, compromising data integrity and potentially propagating misinformation. The weakness is a classic missing authorization failure, identified as CWE‑862.

The plugin sold by wedevs, known as weDocs, is vulnerable in all releases up to and including version 2.1.16. Users running any of those versions should consider the plugin affected.

The CVSS score of 4.3 suggests moderate severity, and the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. The flaw is not yet listed in CISA’s KEV catalog. Because the attack requires authentication, the attack vector is limited to users who have Subscriber or higher permissions, but once accessed the attacker can modify any post without restriction. The partial patch in 2.1.16 adds the missing capability check, so installing that version eliminates the vulnerability.