The weDevs weDocs WordPress plugin, versions 2.6.1 and earlier, suffers a lack of proper authorization checks that allow unauthenticated users to bypass configured security levels. This flaw is classified as CWE-862 and can lead to the exposure of restricted content or the ability to modify plugin settings, thereby compromising confidentiality, integrity, and availability of the site.

All installations of the weDocs plugin from any release through 2.6.1 are affected. Site owners should verify whether the plugin is present and, if so, determine the exact version in use.

The CVSS score of 7.5 denotes high severity. The vulnerability can be exploited by sending crafted HTTP requests to the plugin’s endpoints, an attack path that does not require prior authentication and is likely executed over the public web interface. Because the EPSS score is not available and the flaw is not listed in CISA KEV, no formal exploitation probability is provided, but the high CVSS rating indicates significant risk. Immediate remediation is recommended.