Vulnerabilities / EazyDocs / WPSEC-2026-0143
EazyDocs <= 2.14.0 - Missing Authorization to Unauthenticated Analytics Table Schema Update
Medium 5.3
CWE-862Fixed in 2.14.1
- ID
- WPSEC-2026-0143
- Plugin
- EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder (eazydocs)
- Affected
- from 2.8.0 before 2.14.1
- Remediation
- Update to 2.14.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- EazyDocs on WPSec AttackSurface
- Fix released
- Published
Description
The EazyDocs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the 'eazydocs_table_create' handler hooked to admin_init in versions 2.8.0 to 2.14.0 (earlier versions load the handler only when the Pro Max plan is active). This makes it possible for unauthenticated attackers to run the plugin's analytics table schema update (dbDelta), creating or altering the analytics tables, by sending a request to admin-ajax.php with the 'eazydocs_table_create' parameter.
References
- https://wpsec.com/vuln/WPSEC-2026-0143/
- https://plugins.svn.wordpress.org/eazydocs/tags/2.14.1/
- https://wordpress.org/plugins/eazydocs/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS