What is the CVSS score of EUVD-2026-25394?

EUVD-2026-25394 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

BetterDocs WordPress Plugin EUVD-2026-25394

| CVE-2026-6393 MEDIUM

Missing Authorization (CWE-862)

2026-04-24 Wordfence

GHSA-hpvr-gqf8-j82g

WordPress Authentication Bypass Elementor

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 04:32 vuln.today

EUVD ID Assigned

Apr 24, 2026 - 04:00 euvd

EUVD-2026-25394

Analysis Generated

Apr 24, 2026 - 04:00 vuln.today

CVE Published

Apr 24, 2026 - 03:27 nvd

MEDIUM 4.3

DescriptionCVE.org

The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This is due to a missing capability check in the generate_openai_content_callback() function, which relies solely on a nonce rather than verifying user permissions. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger OpenAI API calls using the site's configured API key with arbitrary user-controlled prompts, leading to unauthorized consumption of the site owner's paid AI API quota.

AnalysisAI

BetterDocs plugin for WordPress versions up to 4.3.11 allows authenticated subscribers and higher to trigger arbitrary OpenAI API calls using the site's configured API key due to missing capability checks in the generate_openai_content_callback() function. An attacker with subscriber-level access can supply arbitrary prompts to exhaust the site owner's paid AI API quota without authorization, resulting in unauthorized financial impact and service degradation. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the generate_openai_content_callback() function within the WriteWithAI.php component of the BetterDocs plugin. The function validates nonce tokens (CSRF protection) but fails to implement WordPress capability checks via functions like current_user_can() that enforce role-based permissions. CWE-862 (Missing Authorization) classifies this as an access control flaw where permission validation is absent entirely. The function directly processes user-supplied prompts and forwards them to OpenAI's API using the site's stored API credentials, bypassing any authorization layer that should restrict this functionality to administrators only.

RemediationAI

Update the BetterDocs plugin to a version newer than 4.3.11 that includes capability checks in the generate_openai_content_callback() function. The WordPress plugin repository Trac shows fixes have been applied; upgrade to the latest available version from the WordPress Plugin Directory. Alternatively, if an immediate patch is not available, restrict subscriber-level user access by reviewing user roles in WordPress admin (Users menu) and downgrading unnecessary subscriber accounts to a role below subscriber or removing their access entirely. Limit OpenAI API key scope and implement usage alerts in your OpenAI account dashboard to monitor for unexpected quota consumption. Review WordPress user access logs to identify if any unauthorized OpenAI API calls have occurred under subscriber accounts. Apply principle of least privilege: assign the 'Contributor' role or lower to users who do not require OpenAI integration, as this vulnerability is exclusive to subscriber-level access and above.