WP Document Revisions <= 5.4.5 - Unauthenticated Missing Authorization via Case-Altered Document REST Routes
- ID
- WPSEC-2026-0080
- Plugin
- WP Document Revisions (wp-document-revisions)
- Affected
- from 3.4.0 before 5.4.6
- Remediation
- Update to 5.4.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-178
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP Document Revisions on WPSec AttackSurface
- Fix released
- Published
Description
The WP Document Revisions plugin for WordPress is vulnerable to an authorization bypass in versions up to, and including, 5.4.5 due to document_validation() comparing the REST route case-sensitively while WordPress matches routes case-insensitively, and not applying its revisions check to the revisions collection route. Requesting a differently cased route (for example /wp/v2/Documents) skips the plugin's additional REST restrictions: unauthenticated attackers can read published documents on sites that restrict reading to the read_documents capability, and authenticated users can bypass the plugin's GET-only and nonce rules for writes WordPress core already permits them. Only sites that enable the REST API for documents (off by default) are affected. Fixed in 5.4.6 on the 5.4.x branch, and in 5.5.1 and 5.6.1 on the newer branches.
References
- https://wpsec.com/vuln/WPSEC-2026-0080/
- https://plugins.svn.wordpress.org/wp-document-revisions/tags/5.4.6/
- https://wordpress.org/plugins/wp-document-revisions/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS