[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpKEeIOsB9r3cwdXqUfb_Xul_Vx-fsC8WL40VooOlaXk":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-12729","wedocs-ai-powered-knowledge-base-docs-documentation-wiki-ai-chatbot-missing-authorization-to-authenticated-subscriber-da","weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \u003C= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action","The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.3.0. This is due to a missing capability check on the do_migration() function registered as the wedocs_migrate_betterdocs_to_wedocs AJAX action, which performs no nonce verification via check_ajax_referer() and no capability check via current_user_can() before executing sensitive operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full BetterDocs-to-weDocs data migration, creating and modifying 'docs' custom post type entries with attacker-controlled titles, updating site options, and deactivating the BetterDocs and BetterDocs Pro plugins via deactivate_plugins().","wedocs",null,"\u003C=2.3.0","2.3.1","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-02 11:59:24","2026-07-03 01:28:20",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F228d63a5-5053-4692-9801-4860325da153?source=api-prod",1,[22,23,24,25,26,27,28,29],"RELEASE_NOTES.md","assets\u002Fbuild\u002Fblocks\u002FBreadcrumb\u002Fstyle-index-rtl.css","assets\u002Fbuild\u002Fblocks\u002FBreadcrumb\u002Fstyle-index.css","assets\u002Fbuild\u002Fblocks\u002FDocNavigation\u002Fstyle-index-rtl.css","assets\u002Fbuild\u002Fblocks\u002FDocNavigation\u002Fstyle-index.css","assets\u002Fbuild\u002Fblocks\u002FQuickSearch\u002Fstyle-index-rtl.css","assets\u002Fbuild\u002Fblocks\u002FQuickSearch\u002Fstyle-index.css","assets\u002Fbuild\u002Fblocks\u002FSidebar\u002Frender.php","researched",false,3,"# Research Plan: CVE-2026-12729 - weDocs Missing Authorization in Data Migration\n\n## 1. Vulnerability Summary\nThe **weDocs** plugin (up to version 2.3.0) contains a missing authorization vulnerability in its data migration utility. Specifically, the function `do_migration()`, which is registered to the `wedocs_migrate_betterdocs_to_wedocs` AJAX action, fails to implement any capability checks (`current_user_can()`) or nonce verification (`check_ajax_referer()`). \n\nThis allows any authenticated user, including those with **Subscriber-level permissions**, to trigger a migration process that can:\n1. Deactivate the `better-docs` and `better-docs-pro` plugins.\n2. Create or modify entries in the `docs` custom post type.\n3. Update site options.\n4. Inject attacker-controlled titles into the documentation.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **AJAX Action**: `wedocs_migrate_betterdocs_to_wedocs`\n- **HTTP Method**: `POST`\n- **Authentication**: Authenticated (Subscriber+)\n- **Parameters**: \n    - `action`: `wedocs_migrate_betterdocs_to_wedocs`\n    - (Inferred) The migration likely processes posts with the `betterdocs` post type. The attacker may need to control content within that post type or provide specific parameters to the migration function if it accepts raw input.\n- **Preconditions**: The attacker must have a valid session cookie for a Subscriber-level user.\n\n## 3. Code Flow\n1. **Entry Point**: A `POST` request is sent to `admin-ajax.php` with `action=wedocs_migrate_betterdocs_to_wedocs`.\n2. **Hook Registration** (Inferred in `includes\u002Fadmin\u002Fclass-migration.php` or similar):\n   ```php\n   add_action( 'wp_ajax_wedocs_migrate_betterdocs_to_wedocs', [ $this, 'do_migration' ] );\n   ```\n3. **Vulnerable Function**: The `do_migration()` function is executed.\n4. **Missing Checks**: The function proceeds immediately to data processing without calling:\n   - `check_ajax_referer()`\n   - `current_user_can( 'manage_options' )`\n5. **Impact Sinks**:\n   - `deactivate_plugins()` is called to disable BetterDocs.\n   - `wp_insert_post()` or `wp_update_post()` is called to create\u002Fmodify `docs` post types.\n   - `update_option()` is called to record migration status.\n\n## 4. Nonce Acquisition Strategy\nAccording to the vulnerability description, the `do_migration()` function **\"performs no nonce verification via check_ajax_referer()\"**. Therefore, **no nonce is required** to exploit this specific vulnerability.\n\nIf a nonce were required, it would likely be localized via `wp_localize_script` in an admin-only script. However, because the check is explicitly stated as missing, the exploit can proceed with just a Subscriber session.\n\n## 5. Exploitation Strategy\n\n### Step 1: Authentication\nObtain a session cookie for a Subscriber-level user.\n\n### Step 2: Trigger Migration\nSend a POST request to trigger the migration. Since this is a migration tool, it likely scans for existing BetterDocs content.\n\n**Request Details**:\n- **URL**: `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method**: `POST`\n- **Headers**: \n    - `Content-Type: application\u002Fx-www-form-urlencoded`\n    - `Cookie: [Subscriber Cookies]`\n- **Body**: `action=wedocs_migrate_betterdocs_to_wedocs`\n\n### Step 3: Verification of Disruption\nThe primary indicator of success is the deactivation of the BetterDocs plugin and the creation\u002Ftransformation of documentation posts.\n\n## 6. Test Data Setup\nTo demonstrate the full impact (creation of docs and deactivation), the following environment must be prepared:\n1. **weDocs 2.3.0** installed and active.\n2. **BetterDocs** (free version) installed and active.\n3. Create a few posts of type `betterdocs` with distinct titles (e.g., \"Secret BetterDoc Title\").\n4. Create a **Subscriber** user: `wp user create attacker attacker@example.com --role=subscriber --user_pass=password`.\n\n## 7. Expected Results\n- **HTTP Response**: 200 OK, likely with a JSON body indicating success or number of items migrated.\n- **Plugin State**: The BetterDocs plugin should be **deactivated** in the WordPress admin.\n- **Post Data**: New posts of type `docs` (weDocs type) should appear in the database, mirroring or modifying the previous BetterDocs entries.\n- **Site Options**: Options like `wedocs_migration_done` (inferred) may be set in `wp_options`.\n\n## 8. Verification Steps\nAfter sending the HTTP request, use WP-CLI to verify the state changes:\n\n1. **Check Plugin Status**:\n   ```bash\n   wp plugin list --status=inactive | grep better-docs\n   ```\n2. **Check Created Documentation**:\n   ```bash\n   wp post list --post_type=docs\n   ```\n3. **Verify Subscriber Ownership** (if applicable):\n   Check if the migration script incorrectly assigned ownership of the new docs to the user who triggered the migration.\n\n## 9. Alternative Approaches\nIf the `action=wedocs_migrate_betterdocs_to_wedocs` requires additional parameters (e.g., specific post IDs or steps):\n1. **Fuzzing Parameters**: Try adding `step=1`, `limit=50`, or `post_ids[]=1`.\n2. **Error-Based Discovery**: Observe if the AJAX response returns errors like \"Missing parameter X\" to refine the payload.\n3. **Source Code Search**: If the environment allows, search for the string `do_migration` in the plugin directory to find the exact expected `$_POST` keys.\n   ```bash\n   grep -rn \"function do_migration\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Fwedocs\u002F\n   ```","The weDocs plugin for WordPress contains a missing authorization vulnerability in its data migration utility. Authenticated attackers with Subscriber-level access or higher can trigger the 'wedocs_migrate_betterdocs_to_wedocs' AJAX action to perform sensitive operations, including deactivating the BetterDocs plugin and modifying documentation custom post types, due to missing capability checks and nonce verification.","\u002F\u002F In the plugin's migration handler class, typically registered in an admin context\n\u002F\u002F No capability check or nonce verification is performed\nadd_action( 'wp_ajax_wedocs_migrate_betterdocs_to_wedocs', [ $this, 'do_migration' ] );\n\n\u002F**\n * Migrates data from BetterDocs to weDocs\n *\u002F\npublic function do_migration() {\n    \u002F\u002F Vulnerability: Missing check_ajax_referer()\n    \u002F\u002F Vulnerability: Missing current_user_can( 'manage_options' )\n\n    $migration_data = $_POST['data'];\n\n    \u002F\u002F Sensitive operation: deactivating competitors\n    deactivate_plugins( [ 'better-docs\u002Fbetter-docs.php', 'better-docs-pro\u002Fbetter-docs-pro.php' ] );\n\n    \u002F\u002F Sensitive operation: modifying documentation posts\n    \u002F\u002F ... migration logic involving wp_insert_post() or update_option() ...\n\n    wp_send_json_success( [ 'message' => __( 'Migration completed', 'wedocs' ) ] );\n}","--- a\u002Fincludes\u002Fadmin\u002Fclass-migration.php\n+++ b\u002Fincludes\u002Fadmin\u002Fclass-migration.php\n@@ -10,6 +10,12 @@\n      * @return void\n      *\u002F\n     public function do_migration() {\n+        check_ajax_referer( 'wedocs_migration_nonce', 'security' );\n+\n+        if ( ! current_user_can( 'manage_options' ) ) {\n+            wp_send_json_error( [ 'message' => __( 'Permission denied', 'wedocs' ) ] );\n+        }\n+\n         $step = isset( $_POST['step'] ) ? sanitize_text_field( $_POST['step'] ) : '';\n         \n         switch ( $step ) {","To exploit this vulnerability, an attacker needs a valid session for any authenticated user (such as a Subscriber). The methodology is as follows:\n\n1.  **Authentication**: Log into the WordPress site as a Subscriber-level user.\n2.  **Request Construction**: Construct a POST request to the `\u002Fwp-admin\u002Fadmin-ajax.php` endpoint.\n3.  **Payload**: Set the 'action' parameter to 'wedocs_migrate_betterdocs_to_wedocs'. Since the function lacks nonce verification and capability checks, no security token is required.\n4.  **Execution**: Send the request. The server will execute the `do_migration()` function, which triggers the deactivation of the BetterDocs and BetterDocs Pro plugins and initiates the data migration process, potentially overwriting or creating documentation entries with attacker-influenced data.","gemini-3-flash-preview","2026-07-25 10:09:02","2026-07-25 10:09:21",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.3.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwedocs\u002Ftags\u002F2.3.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwedocs.2.3.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwedocs\u002Ftags\u002F2.3.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwedocs.2.3.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwedocs\u002Ftags"]