CVE-2026-4348: Unauthenticated SQLi in BetterDocs Pro WordPress Plugin
The National Vulnerability Database reports a critical SQL Injection vulnerability, CVE-2026-4348, affecting BetterDocs Pro plugin for WordPress, versions up to and including 3.7.0. The flaw stems from improper handling of the limit POST parameter within the get_current_letter_docs and docs_sort_by_letter AJAX actions. Instead of proper parameterization by $wpdb->prepare(), the limit parameter is directly interpolated into SQL queries.
This oversight allows unauthenticated attackers to inject additional SQL queries, effectively extracting sensitive information from the database. The vulnerability is exploitable only if the Encyclopedia feature is enabled within BetterDocs Pro settings. With a CVSS score of 7.5 (High), this represents a significant risk for affected WordPress installations, enabling broad data exfiltration without requiring any prior authentication.
Defenders must recognize that unauthenticated SQLi is an attacker’s dream. It’s a low-effort, high-reward vector for initial access and data theft. The attacker’s calculus here is simple: find a vulnerable, publicly exposed WordPress site with BetterDocs Pro, confirm the Encyclopedia feature is enabled, and then dump the database. This isn’t theoretical; this is how breaches happen every single day.
What This Means For You
- If your organization uses BetterDocs Pro on your WordPress sites, you need to immediately check your version. Patch to a fixed version as soon as it's available. Until then, disable the Encyclopedia feature in BetterDocs Pro settings if it’s not strictly necessary. Audit your web server and database logs for any suspicious activity related to `get_current_letter_docs` or `docs_sort_by_letter` AJAX actions.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-4348: BetterDocs Pro SQL Injection via AJAX
title: CVE-2026-4348: BetterDocs Pro SQL Injection via AJAX
id: scw-2026-05-07-ai-1
status: experimental
level: high
description: |
Detects unauthenticated SQL injection attempts targeting the BetterDocs Pro WordPress plugin by looking for POST requests to the admin-ajax.php endpoint, which is commonly used by WordPress plugins for AJAX actions. This rule specifically targets CVE-2026-4348 by focusing on the AJAX endpoint used by the vulnerable plugin.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-4348/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
uri|contains:
- '/wp-admin/admin-ajax.php'
cs-method:
- 'POST'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-4348 | SQLi | BetterDocs Pro plugin for WordPress versions <= 3.7.0 |
| CVE-2026-4348 | SQLi | Vulnerable AJAX action: get_current_letter_docs |
| CVE-2026-4348 | SQLi | Vulnerable AJAX action: docs_sort_by_letter |
| CVE-2026-4348 | SQLi | Vulnerable parameter: limit (POST parameter) |
| CVE-2026-4348 | Misconfiguration | Exploitable when 'Encyclopedia feature' is enabled in BetterDocs Pro settings |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 07, 2026 at 09:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-8063 — Null Pointer Dereference
CVE-2026-8063 — An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the...
WP-Optimize Plugin Flaw Allows Arbitrary File Deletion, RCE via wp-config.php
CVE-2026-7252 — The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary...
CVE-2026-6692: WordPress Slider Revolution RCE Vulnerability
CVE-2026-6692 — The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the '_get_media_url' and '_check_file_path' function....