WP Document Revisions <= 5.4.5 - Authenticated (Subscriber+) Missing Authorization to Password-Protected Document and Revision Access via AI Summary and Diff REST Endpoints
- ID
- WPSEC-2026-0079
- Plugin
- WP Document Revisions (wp-document-revisions)
- Affected
- from 5.0.0 before 5.4.6
- Remediation
- Update to 5.4.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- WP Document Revisions on WPSec AttackSurface
- Fix released
- Published
Description
The WP Document Revisions plugin for WordPress is vulnerable to unauthorized access of data in versions up to, and including, 5.4.5 due to the AI summary and diff REST endpoints (/wpdr/v1/documents/{doc}/revisions/{rev}/summary and /diff) not checking post passwords, and the summary endpoint not requiring the read_document_revisions capability for earlier revisions. This makes it possible for authenticated attackers with Subscriber-level access and above to read AI summaries of password-protected documents and of earlier revisions they may not download, and Contributor-level attackers to read text diffs of password-protected documents. Text extraction is on by default; summaries also need an AI provider. Fixed in 5.4.6 on the 5.4.x branch, and in 5.5.1 and 5.6.1 on the newer branches.
References
- https://wpsec.com/vuln/WPSEC-2026-0079/
- https://plugins.svn.wordpress.org/wp-document-revisions/tags/5.4.6/
- https://wordpress.org/plugins/wp-document-revisions/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS