CVE-2026-42677: WP Document Revisions Auth Bypass Flaw

CVE-2026-42677 Overview

CVE-2026-42677 is a Missing Authorization vulnerability [CWE-862] in the Ben Balter WP Document Revisions plugin for WordPress. The flaw affects all versions prior to 4.0.0 and enables remote unauthenticated attackers to exploit incorrectly configured access control security levels. Attackers can reach restricted plugin functionality over the network without authentication or user interaction. The vulnerability impacts the confidentiality of documents managed by the plugin, allowing unauthorized read access to information that should be protected by access control checks.

Critical Impact
Unauthenticated network attackers can bypass access controls in WP Document Revisions versions before 4.0.0 and retrieve documents that should be restricted to authorized users.

Affected Products

Ben Balter WP Document Revisions plugin for WordPress
All versions from n/a before 4.0.0
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2026-06-01 - CVE-2026-42677 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-42677

Vulnerability Analysis

The vulnerability is a Broken Access Control issue mapped to [CWE-862] Missing Authorization. The WP Document Revisions plugin exposes functionality that does not properly verify whether the requesting user holds the capability required to access the targeted resource. Because the issue is reachable over the network without authentication, an attacker only needs to craft an HTTP request to the affected endpoint.

The impact is limited to confidentiality. Integrity and availability of the WordPress site are not directly affected by this flaw. However, documents stored and revisioned by the plugin frequently include sensitive material such as contracts, internal policies, and draft publications, making unauthorized disclosure consequential for affected sites.

Exploitation does not require user interaction and runs at the original scope of the plugin. The attacker submits requests directly to plugin endpoints that fail to enforce capability or role checks before serving documents or metadata.

Root Cause

The root cause is missing authorization logic in WP Document Revisions code paths that serve protected document content. The plugin relies on incorrectly configured access control checks that do not validate the requesting user against the document's required permission level. The fix in version 4.0.0 introduces proper capability verification before resource access.

Attack Vector

The attack vector is network based. An unauthenticated attacker sends crafted HTTP requests to the WordPress site hosting a vulnerable WP Document Revisions installation. No credentials, tokens, or user interaction are required. See the Patchstack Vulnerability Report for additional technical context.

No public proof-of-concept code has been verified. The vulnerability mechanism follows the standard pattern of WordPress plugin authorization failures: endpoints registered through add_action or REST routes that omit current_user_can() checks before returning document data.

Detection Methods for CVE-2026-42677

Indicators of Compromise

Anonymous HTTP GET or POST requests to WP Document Revisions endpoints returning HTTP 200 with document content
Access log entries showing document download URLs accessed without an authenticated session cookie
Unexpected outbound traffic from wp-content/uploads paths managed by the plugin to unfamiliar source IP addresses

Detection Strategies

Inventory WordPress installations and identify sites running WP Document Revisions versions earlier than 4.0.0
Review web server access logs for requests to plugin routes that succeeded without authenticated session cookies
Correlate document download events with user authentication events to surface mismatches

Monitoring Recommendations

Alert on document retrieval requests originating from IP addresses that have not completed WordPress authentication
Monitor for repeated enumeration patterns against ?p=, REST endpoints, or attachment URLs tied to the plugin
Track plugin version inventory continuously and flag installations that fall behind the patched release

How to Mitigate CVE-2026-42677

Immediate Actions Required

Update WP Document Revisions to version 4.0.0 or later on all affected WordPress sites
Audit existing documents managed by the plugin for unauthorized access in web server logs
Rotate or revoke any sensitive content that may have been exposed prior to patching

Patch Information

The vendor addressed the issue in WP Document Revisions version 4.0.0. Site administrators should update through the WordPress plugin manager or by deploying the updated plugin package. Refer to the Patchstack Vulnerability Report for advisory details.

Workarounds

Deactivate the WP Document Revisions plugin until the update to 4.0.0 can be applied
Restrict access to WordPress document endpoints at the web server or WAF layer to authenticated sessions only
Move sensitive documents off the affected site temporarily if patching cannot be completed promptly

bash

# Configuration example: update WP Document Revisions via WP-CLI
wp plugin update wp-document-revisions --version=4.0.0
wp plugin list --name=wp-document-revisions --fields=name,status,version