What is the CVSS score of CVE-2026-42644?

CVE-2026-42644 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

BetterDocs CVE-2026-42644

EUVD-2026-26215 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-04-29 Patchstack

WordPress Information Disclosure Wordpress Plugin Betterdocs Wpdeveloper

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

CWE-497 information disclosure warrants C:L over C:N; I:N because read-only data retrieval does not affect integrity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:30 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 11:30 euvd

EUVD-2026-26215

CVE Published

Apr 29, 2026 - 10:40 nvd

MEDIUM 5.3

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs betterdocs allows Retrieve Embedded Sensitive Data.This issue affects BetterDocs: from n/a through <= 4.3.10.

AnalysisAI

Sensitive system information in the BetterDocs WordPress knowledge base plugin (WPDeveloper, all versions through 4.3.10) is exposed to unauthenticated remote attackers via CWE-497, enabling retrieval of embedded sensitive data without credentials. Reported by Patchstack and tracked as EUVD-2026-26215, this medium-severity finding carries an EPSS of 0.03% (8th percentile) with no public exploit code or active exploitation recorded at time of analysis. The SSVC framework confirms no known exploitation but flags the attack as automatable, making it a viable target for mass WordPress plugin scanning campaigns.

Technical ContextAI

BetterDocs is a WordPress knowledge base and documentation plugin by WPDeveloper (CPE: cpe:2.3:a:wpdeveloper:betterdocs). The root cause is CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), a vulnerability class where application components inadvertently surface internal or system-level data - such as configuration values, file paths, or embedded API secrets - through responses accessible without authentication. In the WordPress plugin ecosystem, this typically manifests as unprotected REST API endpoints or shortcode output rendering data intended only for internal processing, reachable by any anonymous HTTP client due to WordPress's publicly accessible REST API architecture.

RemediationAI

Update BetterDocs to a version beyond 4.3.10; however, no specific patched version number is confirmed in the available data - the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/betterdocs/vulnerability/wordpress-betterdocs-plugin-4-3-10-sensitive-data-exposure-vulnerability must be consulted to confirm the exact fixed release before upgrading. As an interim compensating control, administrators can restrict unauthenticated access to WordPress REST API endpoints site-wide using a security plugin (e.g., Wordfence, iThemes Security) or server-level firewall rules targeting the /wp-json/ path for non-authenticated clients - note this may break legitimate API consumers. Alternatively, temporarily deactivating the BetterDocs plugin eliminates the exposure surface entirely at the cost of losing all knowledge base functionality until a patched version is confirmed and applied.