WP Document Revisions <= 5.5.0 - Unauthenticated Authorization Bypass via REST Route Case Manipulation
- ID
- WPSEC-2026-0077
- Plugin
- WP Document Revisions (wp-document-revisions)
- Affected
- from 5.5.0 before 5.5.1
- Remediation
- Update to 5.5.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-178
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP Document Revisions on WPSec AttackSurface
- Fix released
- Published
Description
The WP Document Revisions plugin for WordPress is vulnerable to an authorization bypass in version 5.5.0 due to document_validation() comparing the REST route case-sensitively while WordPress matches routes case-insensitively, and not applying its revisions check to the revisions collection route. Requesting a differently cased route (for example /wp/v2/Documents) skips the plugin's additional REST restrictions: unauthenticated attackers can read published documents on sites that restrict reading to the read_documents capability, and authenticated users can bypass the plugin's GET-only and nonce rules for writes WordPress core already permits them. Only sites that enable the REST API for documents (off by default) are affected. Fixed in 5.5.1 on the 5.5.x branch, in 5.4.6 on the 5.4.x branch and in 5.6.1.
References
- https://wpsec.com/vuln/WPSEC-2026-0077/
- https://plugins.svn.wordpress.org/wp-document-revisions/tags/5.5.1/
- https://wordpress.org/plugins/wp-document-revisions/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS