weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot Security & Risk Analysis

The plugin "wedocs" v2.1.18 exhibits a mixed security posture. On the positive side, all SQL queries are properly prepared, there are no file operations, and no critical or high severity taint flows were identified. The plugin also demonstrates a good understanding of nonces and capability checks, with a substantial number implemented.

However, significant concerns arise from the attack surface analysis. Three out of thirteen entry points, specifically AJAX handlers, lack authentication checks. This presents a direct avenue for unauthorized access and potential exploitation. While the current static analysis did not reveal unsanitized paths in taint flows, the presence of unauthenticated AJAX endpoints significantly increases the risk of such issues being present or discoverable.

The vulnerability history, with five known medium severity CVEs, predominantly related to improper authorization and information exposure, further reinforces the concerns around access control. The fact that the last vulnerability was recorded in 2026 suggests that while these issues may have been addressed, the plugin has a track record of authorization-related flaws. The current absence of unpatched vulnerabilities is a positive sign, but the historical pattern warrants vigilance.