CVE-2026-12729 describes a missing authorization vulnerability (CWE-862) in the weDocs: AI Powered Knowledge Base plugin for WordPress, affecting versions up to and including 2.3.0. The vulnerability arises because the do_migration() function, exposed via the wedocs_migrate_betterdocs_to_wedocs AJAX action, lacks nonce verification and capability checks. As a result, authenticated users with low privileges (Subscriber and above) can execute sensitive operations such as migrating data from BetterDocs to weDocs, creating/modifying 'docs' custom post types with attacker-controlled titles, updating site options, and deactivating BetterDocs plugins.

The vulnerability allows authenticated low-privilege users to perform unauthorized actions that can modify site content and configuration. Specifically, attackers can manipulate documentation posts, alter site options, and disable other plugins, potentially disrupting site functionality and integrity. There is no direct confidentiality or availability impact reported, but integrity is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and consider disabling the vulnerable AJAX action if possible. Monitor for updates from the vendor for an official patch or temporary mitigation.