CVE-2025-14574 describes a sensitive information exposure vulnerability in the weDocs WordPress plugin (versions up to 2.1.15). The issue arises from the /wp-json/wp/v2/docs/settings REST API endpoint, which does not properly restrict access, allowing unauthenticated users to retrieve sensitive configuration data including API keys for third-party services. The vulnerability has a CVSS 3.1 score of 5.3 (medium severity), with an attack vector of network (AV:N), no privileges required (PR:N), and no user interaction needed (UI:N). No patch or official fix information is provided in the available data.

An unauthenticated attacker can extract sensitive information such as third-party API keys from the vulnerable REST API endpoint. This exposure could lead to unauthorized use of those services or further compromise depending on the sensitivity of the leaked data. There is no reported impact on integrity or availability, and no known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the /wp-json/wp/v2/docs/settings endpoint through web application firewall rules or other access controls to prevent unauthenticated access to sensitive data.