Read the docs
TI-2026-86458 Aliases CVE-2026-121767GHSA-3rq6-42cq-4f92

Broken access control in weDevs weDocs WordPress plugin

Priority LOW 23CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

CVE-2026-121767 is a missing authorization flaw (CWE-862) in the weDocs plugin for WordPress from weDevs, affecting versions from n/a through 2.6.1. Exploiting it takes advantage of incorrectly configured access control security levels. The CVSS 3.1 base score is 5.3 (MEDIUM), with network attack vector, low complexity, no privileges and no user interaction required. CISA has not added it to KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.

Why it matters now

EPSS 0.00187 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
weDevsweDocsup to 2.6.1—No fix listedCNA
  • weDocs VendorweDevs Affected up to 2.6.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for weDocs.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

  1. 2026-11-07 Threatist record created from CVE-2026-121767
  2. 2026-11-07 Alias added: GHSA-3rq6-42cq-4f92

References

Other 1

  • TI-2021-06932 WP User Frontend < 3.5.29 - Obscure Registration as Admin CVSS 3.1CRITICAL 9.8
  • TI-2024-03660 Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 10.0
  • TI-2024-11873 WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information CVSS 3.1HIGH 7.5
  • TI-2024-11148 SQL Injection in WordPress Project Manager Plugin CVSS 3.1HIGH 7.7
  • TI-2023-02570 WP ERP < 1.12.4 - Admin+ SQL Injection CVSS 3.1HIGH 7.2
  • TI-2023-02569 WP ERP < 1.12.4 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
See all 141 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences