BetterDocs CVE-2026-15104

Two simultaneous conditions must be met: (1) The attacker must possess an authenticated WordPress account with at minimum a 'custom'-level role - the CVSS PR:L vector confirms a low-privilege authenticated requirement, ruling out unauthenticated exploitation. (2) A supported multilingual plugin must be installed and active on the WordPress site - specifically one of WPML, Polylang, qTranslate, Weglot, or TranslatePress - because the vulnerable code path in PostType.php is reached only when Helper::is_multilingual_active() returns true (Helper.php line 344). Sites running BetterDocs without any multilingual plugin are not reachable via this code path regardless of plugin version. Limiting factors: authentication barrier (PR:L) excludes drive-by or unauthenticated attacks; the multilingual plugin gate restricts exposure to a subset of BetterDocs deployments; impact scope is read-only (C:H, I:N, A:N), with no lateral write capability.

The NVD/Wordfence-assigned CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N captures network reachability and high confidentiality impact, but the AC:L designation appears optimistic given the mandatory multilingual-plugin prerequisite - a condition entirely beyond the attacker's control. An independent assessment (see assessed_cvss_vector) adjusts to AC:H to reflect this. EPSS data is absent, preventing probability-of-exploitation quantification. The CVE is not listed in CISA KEV, and no public POC has been identified, both of which reduce urgency relative to the raw CVSS score. Practically, exploitation is limited to a subset of BetterDocs deployments that (a) grant untrusted users custom-level or higher roles, and (b) operate a supported multilingual plugin - a meaningful reduction in the realistic attack surface. The impact is confidentiality-only; no write or availability component exists, limiting blast radius to data exfiltration scenarios such as harvesting WordPress user hashes or private content.

An attacker with a custom-level WordPress account on a target site running BetterDocs ≤4.6.0 and an active multilingual plugin crafts a malicious HTTP request with SQL payload appended to the lang parameter. The request reaches the vulnerable query-construction logic in PostType.php, where the unescaped, unprepared parameter allows the injected SQL to execute against the WordPress database, returning sensitive records such as user email addresses, hashed passwords, or private post content. No public POC exists at time of analysis, but the injection type (generic SQL append) is well-understood and the skill threshold for exploitation is low once a valid account and vulnerable configuration are confirmed.