Knight Squad Academy
Vulnerability advisory

CVE-2025-12505

Research by Md. Moniruzzaman Prodhan December 6, 2025
Overview

Summary

The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the create_item_permissions_check function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global plugin settings.

Risk profile

CVSS assessment

5.4 · M E D I U M
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
N E T W O R K
Complexity
L O W
Privileges
L O W
User interaction
N O N E
Scope
U N C H A N G E D
Confidentiality
L O W
Integrity
L O W
Availability
N O N E
Classification

Weaknesses

  • Weakness classification CWE-285
Further reading

References

5 sources
  1. github.com https://github.com/weDevsOfficial/wedocs-plugin/blob/develop/includes/API/SettingsApi.php
  2. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wedocs/tags/2.1.13/includes/API/SettingsApi.php#L115
  3. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wedocs/tags/2.1.13/includes/API/SettingsApi.php#L179
  4. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3403375%40wedocs%2Ftrunk&old=3382516%40wedocs%2Ftrunk&sfp_email=&sfph_mail=
  5. www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec54ec6-0ff1-4290-85d0-d691a1832627?source=cve