CVE-2025-13921: 
WordPress vulnerability analysis and mitigation

CVE-2025-13921 is a Missing Authorization vulnerability in the weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress. It affects all versions up to and including 2.1.16, where a missing capability check on the wedocs_user_documentation_handling_capabilities function allows authenticated attackers with Subscriber-level access or above to edit any documentation post. The vulnerability was disclosed on January 23, 2026, and was only partially patched in version 2.1.16. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the wedocs_user_documentation_handling_capabilities function in the weDocs plugin does not perform adequate capability checks before allowing users to modify documentation posts. Specifically, the vulnerable logic is present in includes/Installer.php and includes/functions.php, where user roles are not properly validated against the required permissions to edit documentation content. An authenticated attacker with a low-privilege WordPress account (Subscriber or higher) can send crafted requests to invoke this function and modify arbitrary documentation posts without authorization (Wordfence, WordPress Trac).

Successful exploitation allows authenticated low-privilege users to modify or corrupt any documentation post managed by the weDocs plugin, resulting in unauthorized data modification and potential loss of data integrity. There is no confidentiality or availability impact, but an attacker could deface knowledge base content, inject misleading information, or disrupt documentation used by end users or customers. The scope is limited to the WordPress site's documentation content and does not directly enable lateral movement or system-level compromise (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13921. The EPSS score is extremely low at 0.0001, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Subscriber-level access, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain a low-privilege account: Register or obtain a Subscriber-level (or higher) WordPress account on a site running weDocs plugin version 2.1.16 or earlier.
2. Identify target documentation posts: Browse the site's knowledge base or documentation section to identify post IDs of documentation content to be modified.
3. Craft a malicious request: Send an authenticated HTTP request (e.g., via the WordPress REST API or admin-ajax endpoint) invoking the wedocs_user_documentation_handling_capabilities function with parameters targeting the desired documentation post ID and modified content.
4. Submit unauthorized edit: Because the capability check is missing, the server processes the request and applies the unauthorized modification to the targeted documentation post, overwriting legitimate content with attacker-controlled data (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests from low-privilege user accounts to endpoints invoking wedocs_user_documentation_handling_capabilities or related weDocs AJAX actions.
• Logs: Unexpected documentation post revision history entries attributed to Subscriber-level or other low-privilege user accounts in the WordPress database (wp_posts and wp_postmeta tables).
• File System: Unusual or unauthorized changes to weDocs documentation post content, detectable via WordPress post revision auditing or integrity monitoring tools.
• Logs: WordPress debug logs or error logs showing capability check bypasses or unexpected role-based access patterns in the weDocs plugin context.

The vulnerability was partially patched in version 2.1.16 of the weDocs plugin; however, the patch is noted as incomplete. Site administrators should monitor the WordPress plugin repository for a fully remediated release and update to the latest available version as soon as it is published (WordPress Trac). As an interim workaround, administrators should restrict user registration and limit Subscriber-level accounts on affected sites, or temporarily deactivate the weDocs plugin if documentation editing by low-privilege users is not required. Regularly auditing documentation post revision history can help detect unauthorized modifications.

The vulnerability was reported and disclosed by Wordfence, which serves as the CNA for this CVE. No notable public commentary, media coverage, or significant community discussion has been identified beyond standard vulnerability database listings (Wordfence).