What is the CVSS score of CVE-2026-15104?

CVE-2026-15104 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

BetterDocs CVE-2026-15104

EUVD-2026-42840 MEDIUM

SQL Injection (CWE-89)

2026-07-10 Wordfence

GHSA-6r9x-hjc8-pghq

WordPress SQLi Wordpress Plugin Betterdocs Ai Documentation Knowledge Base Docs Wikis Faq With Chatbot Wpdevteam

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Mandatory multilingual plugin dependency is a beyond-attacker-control prerequisite justifying AC:H over vendor-assigned AC:L; PR:L reflects confirmed custom-role authentication requirement.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 09:16 vuln.today

CVE Published

Jul 10, 2026 - 07:48 cve.org

MEDIUM 6.5

DescriptionCVE.org

The BetterDocs - AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' parameter in all versions up to, and including, 4.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a supported multilingual plugin (WPML, Polylang, qTranslate, Weglot, or TranslatePress) to be active on the site, as the vulnerable code path is gated by Helper::is_multilingual_active().

AnalysisAI

SQL Injection in the BetterDocs WordPress plugin (versions up to and including 4.6.0) enables authenticated attackers holding at minimum a custom-level WordPress role to append arbitrary SQL to existing queries via the unsanitized lang parameter, extracting sensitive data from the underlying database. The attack surface is restricted to sites where one of five specific multilingual plugins (WPML, Polylang, qTranslate, Weglot, or TranslatePress) is active, as the vulnerable code path is guarded by Helper::is_multilingual_active(). No public exploit identified at time of analysis; EPSS data unavailable, and the CVE is not listed in CISA KEV.

Technical ContextAI

The vulnerability originates in PostType.php (lines 767 and 819) of the BetterDocs plugin by WPDevTeam, where user-controlled input passed via the lang parameter is neither properly escaped nor channeled through parameterized/prepared SQL statements - the root cause class per CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The logic in Helper.php line 344 gates the vulnerable code path behind a call to Helper::is_multilingual_active(), meaning the injection surface only becomes reachable when a supported multilingual integration is installed and activated. The CPE cpe:2.3:a:wpdevteam:betterdocs_-__ai_documentation,_knowledge_base,_docs,_wikis,_faq_with_chatbot:*:*:*:*:*:*:*:* covers all plugin versions through 4.6.0. The injection allows SQL to be appended to existing queries (a classic second-order or stacked injection pattern), enabling database read-out without necessarily breaking application behavior.

RemediationAI

Upstream fix code is available via WordPress plugin trac changeset 3601408 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3601408%40betterdocs&new=3601408%40betterdocs); users should update BetterDocs to the release version that incorporates this changeset as soon as it appears in the WordPress plugin directory. The exact patched release version number is not confirmed in available data - check the plugin's changelog in the WordPress repository before updating to verify the fix is included. As an immediate compensating control, deactivating all multilingual plugins (WPML, Polylang, qTranslate, Weglot, TranslatePress) disables the vulnerable code path entirely by causing Helper::is_multilingual_active() to return false - this eliminates the attack surface at the cost of multilingual site functionality. Alternatively, audit and reduce the number of WordPress accounts granted custom-level or higher roles, as this limits the pool of potential attackers. No further network-level controls (WAF rules targeting lang parameter injection) are confirmed effective without vendor guidance on exact query patterns.