The weDevs weDocs WordPress plugin, versions up to 2.6.1, contains a missing authorization flaw that allows users or attackers to bypass configured access control settings. This broken access control can expose confidential documents and other sensitive content that should be restricted to authorized users. The weakness is classified as CWE-862, which indicates an authorization bypass that compromises information confidentiality and integrity.

WordPress sites that use the weDevs weDocs plugin are vulnerable if the plugin version is 2.6.1 or earlier. Any site deploying the plugin, regardless of additional customizations, is potentially exposed because the flaw exists across all affected releases up to the highlighted version.

The CVSS base score of 5.3 indicates a medium severity vulnerability. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting that no widespread exploitation has been reported. The most likely attack vector is remote, via the public web interface of the WordPress site, where an attacker can manipulate the plugin’s access parameters to retrieve documents that should be protected. Because the flaw originates from incorrect configuration rather than a code execution vulnerability, the exploitation potential is limited to unauthorized data disclosure rather than full system compromise.