The vulnerability CVE-2025-13921 in the weDocs WordPress plugin is due to a missing capability check in the function responsible for handling user documentation permissions. This allows authenticated users with low privileges (Subscriber-level and above) to edit any documentation post, which they should not be authorized to do. The issue affects all versions up to 2.1.16, where a partial fix was introduced. The CVSS 3.1 base score is 4.3 (medium severity), reflecting the network attack vector, low complexity, required privileges, no user interaction, and impact limited to integrity loss without affecting confidentiality or availability. No vendor advisory or patch link is provided, so the full remediation status is not confirmed.

An attacker with authenticated Subscriber-level access or higher can modify documentation posts without proper authorization. This unauthorized modification can lead to misinformation or loss of data integrity within the documentation managed by the plugin. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

A partial patch was applied in version 2.1.16 of the plugin, but the vulnerability is not fully resolved. Since no official full patch or vendor advisory is provided, users should monitor for updates from the vendor and apply them promptly once available. Until a complete fix is released, restrict user roles to trusted individuals and limit Subscriber-level access where possible to reduce risk.