CVE-2025-12505: 
WordPress vulnerability analysis and mitigation

CVE-2025-12505 is an improper authorization vulnerability in the weDocs plugin for WordPress, allowing authenticated attackers with Subscriber-level access or above to modify global plugin settings without proper authorization checks. It affects all versions of weDocs up to and including 2.1.14. The vulnerability was published on December 6, 2025, and was discovered and reported by Wordfence. It carries a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is an improper authorization flaw (CWE-285) in the create_item_permissions_check function within includes/API/SettingsApi.php. In vulnerable versions (≤2.1.14), this function failed to verify that the requesting user held the manage_options capability before allowing write access to the plugin's REST API settings endpoint (/wp-json/wedocs/v1/settings). As a result, any authenticated user — including those with only Subscriber-level roles — could send a crafted HTTP POST request to this endpoint and overwrite the global wedocs_settings WordPress option, including sensitive configuration such as AI provider API keys and assistant settings. The patched version (2.1.15+) adds a current_user_can('manage_options') check to the create_item_permissions_check function, as visible in the updated source code (GitHub SettingsApi.php, WordPress Trac Changeset).

Successful exploitation allows low-privileged authenticated users to overwrite global plugin settings, including potentially sensitive AI provider API keys (e.g., OpenAI keys), assistant configuration, and other weDocs options stored in the wedocs_settings WordPress option. This results in limited confidentiality impact (exposure of configuration data) and integrity impact (unauthorized modification of plugin settings), with no direct availability impact. While the vulnerability does not grant remote code execution or full site takeover on its own, tampering with AI API keys or assistant settings could disrupt documentation functionality, incur financial costs via API key abuse, or facilitate further attacks if combined with other weaknesses (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-12505. The vulnerability requires authentication (at minimum a Subscriber-level WordPress account), which limits opportunistic exploitation but does not eliminate risk on sites with open registration. The EPSS score is approximately 0.021% (0.000210), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the weDocs plugin version ≤2.1.14 by checking plugin headers, readme files, or using tools like WPScan to enumerate installed plugins and their versions.
2. Obtain authenticated access: Register or log in as a low-privileged user (Subscriber role or above) on the target WordPress site. On sites with open registration, this may require only creating a free account.
3. Craft malicious REST API request: Send an authenticated HTTP POST request to the weDocs settings endpoint, e.g., POST /wp-json/wedocs/v1/settings, including a valid WordPress authentication nonce or cookie, with a JSON body containing the desired settings payload to overwrite.
4. Overwrite global settings: The create_item_permissions_check function in vulnerable versions does not enforce manage_options capability, so the request is accepted and update_option('wedocs_settings', ...) is called with attacker-controlled data, overwriting plugin configuration such as AI API keys or assistant settings.
5. Achieve objective: Depending on intent, the attacker may disable documentation features, replace AI API keys with their own (to intercept queries or incur costs on the victim), or alter assistant behavior to serve malicious content to site visitors (GitHub SettingsApi.php, Wordfence).

• Network: Unexpected authenticated HTTP POST requests to /wp-json/wedocs/v1/settings from low-privileged user accounts; requests originating from unusual IP addresses or user agents targeting this REST endpoint.
• Logs: WordPress access logs showing POST requests to the weDocs settings REST API endpoint from non-administrator user accounts; repeated or automated requests to this endpoint in a short timeframe.
• WordPress Database: Unexpected changes to the wedocs_settings option in the wp_options table, particularly modifications to AI provider API keys, assistant configuration, or other plugin settings not made by an administrator.
• Application Behavior: Sudden changes in weDocs plugin behavior, such as AI assistant malfunctions, altered documentation settings, or unexpected API key usage charges from third-party AI providers.

The vendor (weDevs) has released a patched version of the weDocs plugin that adds proper manage_options capability checks to the create_item_permissions_check function. Site administrators should update the weDocs plugin to version 2.1.15 or later immediately via the WordPress plugin dashboard or by downloading the latest version from the WordPress plugin repository. As a temporary workaround prior to patching, administrators can disable open user registration on the WordPress site to reduce the attack surface, or use a web application firewall (WAF) rule to block unauthenticated or low-privileged POST requests to /wp-json/wedocs/v1/settings (Wordfence, WordPress Trac Changeset).

The vulnerability was reported and disclosed by Wordfence, which published a threat intelligence entry detailing the flaw. Red Hat also tracked the CVE in their security advisory database. No significant broader media coverage, notable researcher commentary, or social media discussion beyond standard vulnerability aggregator postings has been identified for this CVE (Wordfence, Red Hat CVE).