The weDocs plugin for WordPress contains an authentication flaw that allows unauthenticated attackers to access the /wp-json/wp/v2/docs/settings REST API. This endpoint returns sensitive configuration data, including third‑party API keys, which can be used to compromise connected services. The vulnerability conforms to CWE‑200: Information Exposure, leading to confidentiality loss and potential downstream exploitation of the exposed services.

All installations of the weDocs plugin with versions 2.1.15 or earlier are affected. The plugin is maintained by wedevs and distributed through the WordPress plugin repository. The vulnerability is present in every installation that has not yet upgraded to the patched release 2.1.16.

The CVSS score of 5.3 places this vulnerability in the moderate risk category. The EPSS score indicates a very low likelihood of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The issue can be exploited simply by making an unauthenticated GET request to the exposed REST endpoint; no additional privileges are required. This makes the attack straightforward, but the low exploitation probability mitigates the overall risk to some extent.