weDocs Missing Authorization to Authenticated Data Migration via AJAX (CVE-2026-12729)

Vulnerability Overview Vulnerability Name: weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action CVE ID: CVE-2026-12729 CVSS Score: 4.3 (Medium) Release Date: July 2, 2026 Last Updated: July 3, 2026 Researcher: PRISM Affected Scope Software Type: Plugin Software Name: weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot Affected Versions: <= 2.3.0 Fixed Version: 2.3.1 Remediation Recommendation: Update to version 2.3.1 or later. Vulnerability Description The vulnerability exists in the weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin, specifically within the AJAX action. This action allows authenticated users (Subscriber level and above) to perform sensitive operations, such as data migration, creating and modifying documents, without proper authorization checks. This could lead to unauthorized data access and modification. Reference Links plugins.trac.wordpress.org Additional Information Software Status: Fixed Patch Version: 2.3.1 Recent Related Vulnerabilities weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via connectorWidth/ Block Attribute - CVE ID: CVE-2026-12734 - CVSS Score: 6.4 - Researcher: PRISM - Release Date: July 2, 2026 weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sectionTitleTag and articleTitleTag/ Block Attributes - CVE ID: CVE-2026-12731 - CVSS Score: 6.4 - Researcher: PRISM - Release Date: July 2, 2026 weDocs <= 2.1.18 - Missing Authorization - CVE ID: CVE-2026-39520 - CVSS Score: 5.3 - Researcher: hhai - Release Date: February 25, 2026 weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update - CVE ID: CVE-2026-13921 - CVSS Score: 4.3 - Researcher: blue0x1 - Release Date: January 22, 2026 weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure - CVE ID: CVE-2025-14574 - CVSS Score: 5.3 - Researcher: DityaRA - Release Date: January 8, 2026 weDocs <= 2.1.14 - Missing Authorization to Settings Update - CVE ID: CVE-2025-12505 - CVSS Score: 5.4 - Researcher: Md. Moniruzzaman Prodhun (Noman/Prodhun) - Release Date: December 5, 2025 weDocs <= 2.1.4 - Missing Authorization - CVE ID: CVE-2024-34442 - CVSS Score: 5.3 - Researcher: Peng Zhou - Release Date: May 7, 2024 Appsero <= 1.2.1 - Missing Authorization - CVE ID: CVE-2022-47150 - CVSS Score: 4.3 - Researcher: István Márton - Release Date: December 14, 2022 Additional Information Copyright: 2012-2026 Defiant Inc. License: Defiant grants a permanent, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, distribute, and disseminate Common Vulnerabilities and Exposures (CVE) information. Contact: If you have any errors or need more information, please contact support@wordfence.com. Additional Resources Wordfence Intelligence: Provides free personal and commercial API access to the WordPress vulnerability database. Wordfence WordPress Plugin: Install to receive immediate notifications about new vulnerabilities. Documentation: Provides documentation on how to access and use the vulnerability database API. Footer Information Business Hours: 9am-6pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). Support: 24/7 support, 365 days a year, with a 1-hour response time. Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Social Media: X, Facebook, LinkedIn, Instagram Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Subscribe: Register to receive news and updates from experienced security professionals. Email: example@example.com Agreement: By checking this box, you agree to the Terms of Service and Privacy Policy. Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Logo: CRESCENT

Goal Reached Thanks to every supporter — we hit 100%!

weDocs Missing Authorization to Authenticated Data Migration via AJAX (CVE-2026-12729)

More from this source