CVE-2023-6029 is a high severity (CVSS 7.5 in the record) flaw in the EazyDocs WordPress plugin before 2.3.6. It lacks authorization and CSRF checks when handling documents, so arbitrary posts can be deleted and documents or sections added or removed. Update to 2.3.6. WPScan scores it 6.5 Medium.
What's affected
- Plugin: EazyDocs for WordPress, by Spider Themes.
- Affected: versions before 2.3.6.
- Fixed: 2.3.6, per the NVD record and WPScan.
- Severity: 7.5 High in the NVD record. WPScan scores it 6.5 Medium.
- Source difference: the NVD record says unauthenticated users. WPScan's write-up describes any authenticated user, such as a subscriber. Plan for the wider reading.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under EazyDocs. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for EazyDocs and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The folder is eazydocs.
A version below 2.3.6 is affected. If the plugin has been active, also compare your current post and documentation counts against a recent backup, since the flaw includes deleting posts that are not even documents.
What to do now
- Update EazyDocs to 2.3.6 or later.
- Compare current content against a recent backup to spot missing posts, pages or documentation sections.
- Restore anything deleted from backup, and confirm that the restore includes media and metadata.
- Limit user registration, so unknown people cannot create the low privilege accounts that the flaw may need.
- Keep regular backups outside the web server, so a deletion can be reversed.
Why it matters
The plugin handles actions to create and delete documents through requests that do not check the caller's role and do not verify a nonce. The record gives CWE-862, missing authorization. The lack of CSRF protection adds a second path: someone could trick a logged-in administrator into triggering the action from another page.
The unusual detail is that the delete action does not confirm that the target is one of the plugin's documents. So a request meant for a document can remove any post. The impact is integrity and availability of site content, not data theft. Content loss on a documentation site can still hurt, and backups are the recovery plan. The record does not list this CVE as known exploited.
Quick check
Is this about stolen data?
No. The impact is on integrity and availability: posts and documentation can be removed or added. Nothing in the sources describes data theft.
Sources
Last reviewed: 19 October 2026.
