The weDocs WordPress plugin contains an AJAX handler, wedocs_migrate_betterdocs_to_wedocs, that calls the do_migration() routine without performing any nonce validation or capability checks. This flaw is a missing authorization vulnerability (CWE‑862). An authenticated user who holds a Subscriber role or higher can invoke the migration action to trigger a complete transfer of content from the BetterDocs plugin to weDocs. The migration creates or updates \'docs\' custom post type entries with attacker‑controlled titles, alters site options, and deactivates both BetterDocs and BetterDocs Pro through an unprotected deactivate_plugins() call, effectively disrupting the site’s documentation functionality.

WordPress installations running the wedevs:weDocs plugin, up to and including version 2.3.0, are affected regardless of host or PHP version. Any account with Subscriber level or higher access is able to perform the unauthorized migration.

The CVSS score of 4.3 denotes medium severity, and the EPSS score is reported as < 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. However, since exploitation requires only an authenticated session at the Subscriber level, a user can modify, create, or delete documentation entries and disable key plugins, leading to data integrity issues and site disruption. The impact on data and functionality can be significant if an attacker gains legitimate access.