What is the CVSS score of CVE-2026-4348?

CVE-2026-4348 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of BetterDocs Pro are affected by CVE-2026-4348?

BetterDocs Pro for WordPress contains an unauthenticated SQL injection vulnerability in its Encyclopedia feature that allows attackers to extract sensitive database contents without authentication.

How to fix or mitigate CVE-2026-4348?

Within 24 hours: Disable the Encyclopedia feature in BetterDocs Pro or restrict access via Web Application Firewall rules blocking requests to affected AJAX endpoints. Within 7 days: Contact BetterDocs support for security guidance and monitor their advisory channels for patch availability. Within 30 days: Upgrade to BetterDocs Pro version 3.7.1 or later once vendor releases a patched version, or migrate to an alternative documentation plugin if patch timeline is unacceptable.

BetterDocs Pro CVE-2026-4348

EUVD-2026-28319 HIGH

SQL Injection (CWE-89)

2026-05-07 Wordfence

GHSA-89cx-53rv-jcx8

SQLi WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 05:45 vuln.today

CVE Published

May 07, 2026 - 04:27 nvd

HIGH 7.5

DescriptionCVE.org

The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the get_current_letter_docs and docs_sort_by_letter AJAX actions in all versions up to, and including, 3.7.0. This is due to the limit POST parameter being interpolated directly into a SQL query string before being passed to $wpdb->prepare(), which only parameterizes other variables. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The Encyclopedia feature must be enabled in BetterDocs Pro settings for the vulnerability to be exploitable.

AnalysisAI

Unauthenticated SQL injection in BetterDocs Pro for WordPress allows remote attackers to extract sensitive database contents when the Encyclopedia feature is enabled. The vulnerability affects all versions up to 3.7.0 through unsanitized 'limit' parameters in two AJAX endpoints. With CVSS 7.5 (High severity) and network-based unauthenticated attack vector, this presents significant risk to sites using the Encyclopedia feature, though no active exploitation (KEV) or public POC has been identified at time of analysis. EPSS data not available for risk calibration.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a WordPress plugin's AJAX handler implementation. The flaw occurs in BetterDocs Pro's get_current_letter_docs and docs_sort_by_letter AJAX actions, which are designed to support the plugin's Encyclopedia feature for organizing documentation alphabetically. The vulnerable code concatenates the user-supplied 'limit' POST parameter directly into a SQL query string before passing it to WordPress's $wpdb->prepare() function. While prepare() is intended to safely parameterize database queries, it only sanitizes variables explicitly marked with placeholders - any values already concatenated into the query string bypass this protection entirely. This implementation error is particularly dangerous because WordPress AJAX endpoints with 'nopriv' registration are accessible to unauthenticated users by default. The vulnerability affects the cpe:2.3:a:betterdocs:betterdocs_pro product line, demonstrating how even security-conscious frameworks like WordPress require developers to use their sanitization APIs correctly rather than mixing string concatenation with parameterized queries.

RemediationAI

Upgrade BetterDocs Pro to version 3.7.1 or later if available, verifying the fix version from the official changelog at https://betterdocs.co/changelog/ and vendor communications. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5c0f02ad-f5f1-42b1-8116-e391aaa85430?source=cve provides technical details for validation. As an immediate compensating control, disable the Encyclopedia feature in BetterDocs Pro settings (typically under BetterDocs > Settings > Encyclopedia) to eliminate the vulnerable code path entirely - this prevents exploitation but removes Encyclopedia functionality for users. For sites requiring Encyclopedia features, implement WordPress application firewall rules (via Wordfence, Sucuri, or similar WAF) to filter AJAX requests to wp-admin/admin-ajax.php where action parameters equal get_current_letter_docs or docs_sort_by_letter and limit parameters contain SQL metacharacters (quotes, semicolons, UNION keywords, comment markers). This WAF approach may cause false positives with legitimate large limit values and requires tuning. Database-level monitoring for unusual SELECT queries from the WordPress database user can provide detection capability but does not prevent exploitation. Review database access logs for suspicious query patterns in the period prior to patching to identify potential historical compromise.