CVE-2026-12729 affects the weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot WordPress plugin versions up to and including 2.3.0. The vulnerability arises from the do_migration() function, which is registered as the wedocs_migrate_betterdocs_to_wedocs AJAX action. This function lacks nonce verification (no check_ajax_referer()) and capability checks (no current_user_can()) before executing sensitive operations. As a result, authenticated attackers with Subscriber-level privileges or higher can trigger a full migration from BetterDocs to weDocs, allowing them to create and modify 'docs' custom post type entries with attacker-controlled titles, update site options, and deactivate the BetterDocs and BetterDocs Pro plugins via deactivate_plugins().

An attacker with low-level authenticated access (Subscriber or above) can exploit this vulnerability to manipulate documentation content, alter site options, and disable competing plugins. This could lead to unauthorized content changes and disruption of site functionality related to documentation plugins. There is no direct confidentiality or availability impact reported, but integrity and operational control are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to the AJAX migration action. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor updates for patches addressing this missing authorization issue.