BetterDocs CVE-2026-42644

No authentication is required (CVSS PR:N, UI:N) and the vulnerability is reachable over the network from any remote client with no elevated privileges (AV:N, AC:L). The sole prerequisite is that the BetterDocs plugin version 4.3.10 or earlier is installed and active on the WordPress site. No non-default configuration is indicated as a trigger. Factors that limit exploitation impact in practice include: the actual sensitivity of the data exposed (benign metadata versus credentials or API keys determines whether exploitation leads to further compromise); whether the WordPress REST API is restricted site-wide by server configuration or a security plugin; and the absence of any current public exploit code, which reduces opportunistic targeting despite the automatable attack surface.

The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) contains a material anomaly: C:N (no confidentiality impact) is assigned to a vulnerability explicitly classified as CWE-497 sensitive data exposure and tagged 'Information Disclosure' - these are directly contradictory. Conversely, I:L (integrity impact) appears misattributed for what the description frames as a read-only data retrieval operation. This discrepancy should be verified with NVD or the vendor before using the provided vector for prioritization decisions. Independent assessment corrects this to C:L/I:N, yielding the same 5.3 score but more accurately characterizing the impact type. Beyond the scoring anomaly, real-world risk is low: EPSS 0.03% (8th percentile) signals minimal observed or predicted exploitation, CISA KEV has no listing, and no POC exists. SSVC's 'automatable: yes' flag is the primary escalation signal - this vulnerability could be swept up in opportunistic plugin enumeration campaigns, but actual harm depends entirely on how sensitive the exposed data is in practice.

An unauthenticated attacker submits a crafted HTTP GET request to a publicly accessible BetterDocs REST API endpoint or a WordPress page rendering a vulnerable shortcode, and receives a response body containing embedded sensitive system information such as internal configuration values, file paths, or API credentials. No public proof-of-concept code has been identified at time of analysis, but the zero-prerequisite, network-accessible nature of the attack makes it trivially automatable by scanning tools targeting WordPress installations with BetterDocs active.