CVE-2026-39520: 
WordPress vulnerability analysis and mitigation

CVE-2026-39520 is a Missing Authorization (Broken Access Control) vulnerability in the weDevs weDocs WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects weDocs versions up to and including 2.1.18, with version 2.2.1 being the patched release. The vulnerability was reported on January 26, 2026, by researcher 'hhhhai' and published by Patchstack on February 25, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate permission checks before executing certain privileged actions. An unauthenticated remote attacker can send network requests to trigger functionality that should be restricted to higher-privileged users, exploiting incorrectly configured access control security levels within the plugin. No user interaction is required, and the attack complexity is low, making it straightforward to exploit over the network (Patchstack).

Successful exploitation allows unauthorized users to bypass permission checks and perform actions reserved for higher-privileged roles, resulting in a low integrity impact with no confidentiality or availability impact according to the CVSS scoring. In practice, this means attackers could access or manipulate restricted documentation content within the weDocs plugin without authentication. The vulnerability is noted as being used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack).

The vulnerability requires no authentication and no user interaction, making it accessible to any remote attacker. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the wild. No specific threat actor attribution, active in-the-wild exploitation campaigns, or CISA KEV catalog listing have been reported for this CVE. Patchstack classifies the priority as low, noting it is unlikely to be exploited in a targeted manner, though the broken access control class of vulnerability is commonly used in mass-exploit campaigns against WordPress plugins (Patchstack).

The vendor has released a patched version of the weDocs plugin. Administrators should update to version 2.2.1 or later immediately to remediate the vulnerability. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).