Vulnerability · Published Nov 7, 2026 · Assigned by Patchstack

CVE-2026-121767WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability

Medium 5.3

In plain English

A medium-severity missing authorization in weDocs from weDevs. There are no confirmed reports of exploitation so far.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)–no EPSS score yet

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.

Affected products (as reported)

Vendor	Product	Versions
weDevs	weDocs	0 – through 2.6.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://patchstack.com/database/wordpress/plugin/wedocs/vulnerability/wordpress-wedocs-plugin-2-6-1-broken-access-control-vulnerability?_s_id=cve vdb-entry