[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsCbbwjv2ibozYzTq3_3XLWrJDjsJcY8vc3QR3DqNJHE":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-15104","betterdocs-authenticated-custom-sql-injection-via-lang-parameter","BetterDocs \u003C= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter","The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' parameter in all versions up to, and including, 4.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a supported multilingual plugin (WPML, Polylang, qTranslate, Weglot, or TranslatePress) to be active on the site, as the vulnerable code path is gated by Helper::is_multilingual_active().","betterdocs",null,"\u003C=4.6.0","4.6.1","medium",6.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-09 19:06:20","2026-07-10 07:48:40",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F05dbb5f4-b73b-46b4-9177-ba1d36fe0ee7?source=api-prod",1,[22,23,24,25,26,27,28,29],"README.txt","assets\u002Fadmin\u002Fjs\u002Fdashboard.asset.php","assets\u002Fadmin\u002Fjs\u002Fdashboard.js","assets\u002Fadmin\u002Fjs\u002Fquick-setup.asset.php","assets\u002Fadmin\u002Fjs\u002Fquick-setup.js","betterdocs.php","includes\u002FCore\u002FPostType.php","includes\u002FPlugin.php","researched",false,3,"I cannot fulfill this request. I am prohibited from generating actionable exploitation material, including research plans, step-by-step guides, or specific payloads designed to exploit vulnerabilities in software. My safety guidelines prioritize preventing real-world harm, which includes declining requests that act as a force multiplier for cyberattacks.\n\nFor information on how to identify and remediate similar security issues, I recommend searching for resources on **WordPress Plugin Security Best Practices**, specifically regarding:\n*   The proper use of the **`$wpdb->prepare()`** method for parameterizing database queries.\n*   The **WordPress REST API** security model and the use of `permission_callback`.\n*   Input validation and sanitization techniques using functions like `sanitize_text_field()` and `absint()`.\n*   The **OWASP Top 10** guidance on SQL Injection prevention.\n\nResources such as the **WordPress Plugin Handbook** provide extensive documentation for developers on building secure extensions and protecting against common attack vectors.","BetterDocs (\u003C= 4.6.0) is vulnerable to SQL Injection through the 'lang' parameter in REST API requests for document categories and tags. This occurs because the plugin lacks proper escaping and SQL preparation when processing the language filter, particularly when a multilingual plugin like WPML or Polylang is active, allowing authenticated users with docs-level permissions to extract database information.","\u002F\u002F includes\u002FCore\u002FPostType.php (Line 102)\nadd_filter( 'rest_doc_category_query', [ $this, 'modify_doc_category_rest_query' ], 10, 2 );\n\n---\n\n\u002F\u002F includes\u002FCore\u002FPostType.php (Line 144)\nadd_filter( 'rest_doc_tag_query', [ $this, 'modify_doc_tag_rest_query' ], 10, 2 );\n\n---\n\n\u002F\u002F includes\u002FCore\u002FPostType.php (Lines 117-142)\n\u002F\u002F Expose (and allow setting) a term's language for WPML\u002FPolylang so the React\n\u002F\u002F admin can show a language filter bar + a language selector. Applies to both\n\u002F\u002F the doc_category and doc_tag taxonomies.\nforeach ( [ $this->category, $this->tag ] as $bd_lang_taxonomy ) {\n\tregister_rest_field(\n\t\t$bd_lang_taxonomy,\n\t\t'lang',\n\t\t[\n\t\t\t'get_callback'    => function ( $item ) use ( $bd_lang_taxonomy ) {\n\t\t\t\tif ( ! Helper::is_multilingual_active() ) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t\t$term = get_term( $item['id'], $bd_lang_taxonomy );\n\t\t\t\treturn ( $term && ! is_wp_error( $term ) ) ? Helper::get_term_language( $term ) : '';\n\t\t\t},\n\t\t\t'update_callback' => function ( $value, $term ) {\n\t\t\t\tif ( ! current_user_can( 'edit_docs' ) || ! Helper::is_multilingual_active() ) {\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tHelper::set_term_language( $term, sanitize_text_field( (string) $value ) );\n\t\t\t},\n\t\t\t'schema'          => [\n\t\t\t\t'type'    => [ 'string', 'null' ],\n\t\t\t\t'context' => [ 'view', 'edit' ],\n\t\t\t],\n\t\t]\n\t);\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbetterdocs\u002F4.6.0\u002Fassets\u002Fadmin\u002Fjs\u002Fdashboard.asset.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbetterdocs\u002F4.6.1\u002Fassets\u002Fadmin\u002Fjs\u002Fdashboard.asset.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbetterdocs\u002F4.6.0\u002Fassets\u002Fadmin\u002Fjs\u002Fdashboard.asset.php\t2026-07-07 09:55:00.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbetterdocs\u002F4.6.1\u002Fassets\u002Fadmin\u002Fjs\u002Fdashboard.asset.php\t2026-07-09 11:26:26.000000000 +0000\n@@ -1 +1 @@\n-\u003C?php return array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-data', 'wp-date', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-media-utils', 'wp-url'), 'version' => 'ebf8115eb196d6faa129');\n+\u003C?php return array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-data', 'wp-date', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-media-utils', 'wp-url'), 'version' => '0b931dd7721a0b1f161f');","The vulnerability is exploited by targeting the WordPress REST API endpoints for BetterDocs taxonomies, such as `\u002Fwp-json\u002Fwp\u002Fv2\u002Fdoc_category` or `\u002Fwp-json\u002Fwp\u002Fv2\u002Fdoc_tag`. An attacker requires authentication with 'Custom' or higher privileges (possessing the `edit_docs` capability). For the exploit to succeed, a multilingual plugin like WPML or Polylang must be active on the target site. The attacker includes a malicious SQL payload in the 'lang' query parameter. This parameter is used by the plugin to modify the term query without proper sanitization or use of $wpdb->prepare, allowing for information disclosure via time-based or boolean-based SQL injection.","gemini-3-flash-preview","2026-07-15 11:17:06","2026-07-15 11:18:10",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","4.6.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbetterdocs\u002Ftags\u002F4.6.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbetterdocs.4.6.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbetterdocs\u002Ftags\u002F4.6.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbetterdocs.4.6.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbetterdocs\u002Ftags"]