A missing authorization flaw in the Fahad Mahmood WP Docs plugin allows an attacker to bypass the plugin’s access control settings and potentially view or manipulate documents that should be restricted. The vulnerability is due to incorrectly configured security levels, enabling unauthorized users to perform actions normally limited to privileged roles. This can lead to unauthorized disclosure of sensitive content or unintended modification of documents stored in WordPress.

WordPress sites utilizing the WP Docs plugin by Fahad Mahmood, versions from the initial release (n/a) through 2.2.8, are affected. The vulnerability applies when the plugin is active and the access control configuration is not properly enforced.

The CVSS score of 5.4 indicates a moderate impact, while an EPSS score below 1% points to a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, so it is not known to have been actively exploited. Exploitability typically requires sending crafted requests to the plugin’s endpoints, and no special credentials or elevated privileges are necessary. The attack vector is likely remote via web requests to the affected plugin, making it accessible to any internet‑reachable user of the site.