WordPress Plugin Vulnerabilities

weDocs < 2.1.15 - Subscriber+ Settings Update

Description

The plugin is vulnerable to unauthorized access due to the plugin not properly verifying that a user is authorized to perform an action in the create_item_permissions_check function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global plugin settings.

Affects Plugins

Plugin icon
wedocs
Fixed in 2.1.15

References

CVE
CVE-2025-12505
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec54ec6-0ff1-4290-85d0-d691a1832627

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Md. Moniruzzaman Prodhan (NomanProdhan)
Verified
No
WPVDB ID
b8b98955-d2f2-4856-baee-1a3e0c8cc94f

Timeline

Publicly Published
2025-12-05 (about 5 months ago)
Added
2025-12-08 (about 5 months ago)
Last Updated
2025-12-08 (about 5 months ago)

Other

Published
Title
Published
2026-02-09
Title
YayCurrency < 3.3.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Published
2026-01-21
Title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery < 1.8.37 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion
Published
2024-01-31
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.7 - Missing Authorization via restore_records()
Published
2024-11-15
Title
PostX < 4.1.17 - Missing Authorization to Arbitrary Plugin Installation/Activation
Published
2026-02-03
Title
Fortis for WooCommerce < 1.3.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint