BetterDocs Pro CVE-2026-4348

Encyclopedia feature must be explicitly enabled in BetterDocs Pro settings - this is the SPECIFIC configuration requirement that gates exploitation. Without Encyclopedia enabled, the vulnerable AJAX actions (get_current_letter_docs and docs_sort_by_letter) are not registered or callable, making the vulnerability unexploitable regardless of version. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no other limiting factors: exploitation is possible remotely over HTTP/HTTPS against default WordPress AJAX endpoints, requires no authentication (WordPress nopriv AJAX actions are publicly accessible), involves no user interaction, and works against standard BetterDocs Pro installations. The vulnerability is not limited by specific WordPress versions, hosting configurations, or PHP settings. Defenders can assess realistic risk by determining whether Encyclopedia feature is enabled: sites without this feature enabled face zero practical risk from this CVE despite vulnerable code being present. This significantly reduces the actual attack surface compared to the CVSS severity score, as Encyclopedia is an optional feature rather than core plugin functionality.

Real-world risk assessment reveals a nuanced threat profile. The CVSS 7.5 score accurately reflects high confidentiality impact (C:H) with network-based unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N), indicating this is objectively a serious vulnerability from a technical perspective. However, several factors moderate practical risk: (1) The Encyclopedia feature must be explicitly enabled in BetterDocs Pro settings, limiting the attack surface to a subset of installations. (2) No CISA KEV listing indicates no confirmed widespread exploitation campaigns. (3) Wordfence Threat Intelligence documented this as a research finding rather than incident response, suggesting discovery through code audit rather than active abuse. (4) The impact scope is limited to confidentiality (I:N/A:N) - attackers can read database contents but not modify data or achieve code execution directly. (5) No public POC is referenced, raising the barrier for opportunistic exploitation. SSVC decision framework suggests 'scheduled' priority rather than 'immediate' for most organizations: exploitation is 'none' currently, technical impact is 'partial' (data exposure not system compromise), and automatable attack complexity is moderate (requires identifying Encyclopedia-enabled targets). Priority increases significantly for high-value WordPress sites with sensitive data in their databases and Encyclopedia feature enabled. The absence of EPSS scoring prevents probabilistic risk comparison to similar vulnerabilities.

An unauthenticated remote attacker identifies a WordPress site running BetterDocs Pro with Encyclopedia feature enabled (detectable through front-end DOM inspection or by testing the AJAX endpoints directly). The attacker crafts a malicious HTTP POST request to /wp-admin/admin-ajax.php with action=get_current_letter_docs and a weaponized limit parameter such as '10 UNION SELECT user_login,user_pass,user_email FROM wp_users--' which bypasses $wpdb->prepare() sanitization. The manipulated SQL query executes with WordPress database privileges, returning sensitive data including password hashes, email addresses, and other wp_users table contents in the AJAX response. The attacker iterates through different table names and column structures to exfiltrate complete database contents including posts, custom fields, and potentially credentials for other integrated systems stored in wp_options or custom tables.