BetterDocs Pro CVE-2026-7515

The BetterDocs Pro plugin must be installed and active on the target WordPress site at version 3.8.0 or earlier, and the endpoint that consumes the doc_style parameter must be network-reachable (default for any public WordPress site). No authentication, user interaction, or non-default configuration is required (PR:N/UI:N/AC:L). Achieving full code execution (as opposed to information disclosure) additionally requires that an attacker can place or influence a .php file somewhere on the filesystem - e.g. via a separate file-upload weakness, a writable log, or a misconfigured uploads directory - which the description explicitly calls out as a limiting factor; pure information disclosure and access-control bypass via inclusion of existing bundled .php files do not require that secondary primitive.

All available signals point to genuinely high real-world risk rather than an inflated score. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description - the doc_style parameter is reachable over HTTP without authentication or user interaction, and successful inclusion of any attacker-controlled or attacker-influenced .php file yields full PHP execution under the web server account. EPSS, KEV listing and SSVC decision data were not supplied in the input, so probability of exploitation cannot be quantitatively confirmed; however WordPress LFI/LFI-to-RCE issues in popular commercial plugins are historically scanned for at scale by botnets within days of disclosure. No public exploit identified at time of analysis, and no active-exploitation evidence has been provided, so this should be treated as imminent-risk rather than confirmed in-the-wild.

An unauthenticated attacker sends a single crafted GET or POST request to a BetterDocs Pro endpoint with a doc_style parameter pointing at a server-side .php file - for example a previously uploaded image-renamed-to-php, a log file controlled via another endpoint, or a sensitive bundled file - causing WordPress to include it and execute the PHP within. Chained with any writable upload primitive (media library, avatars, or a separate vulnerable plugin), this yields full webshell-grade RCE; even without an upload primitive the attacker can read sensitive configuration via PHP filter chains and pivot to credential theft.