weDocs WordPress Plugin Missing Authorization Vulnerability Allows Unauthorized Post Edits

A vulnerability exists in the weDocs WordPress plugin, specifically in versions through 2.1.16, due to a lack of proper capability checks. This flaw enables authenticated users with Subscriber-level access and higher to modify any documentation post. The issue arises from the 'wedocs_user_documentation_handling_capabilities' function, which fails to enforce necessary authorization. Although version 2.1.16 introduced a partial fix, the vulnerability persists in earlier versions.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in documentation posts, potentially allowing for the manipulation of information presented to users.

Remediation

Users can update to version 2.1.17 or a later patched version to address this vulnerability.