CVE-2026-15104: SQL Injection in BetterDocs WordPress Plugin – Patch & Detection Guide

Technical summary

CVE-2026-15104 is a database query injection flaw (CWE-89) in BetterDocs versions ≤4.6.0. The 'lang' parameter is passed into SQL queries without adequate escaping or prepared statement binding. The vulnerability is conditional on the Helper::is_multilingual_active() function returning true, meaning at least one of five multilingual plugins must be enabled. An authenticated attacker with custom-level access (or roles above it) can craft malicious input to append arbitrary SQL clauses, bypassing the intended query logic and accessing unauthorized database records. The CVSS 3.1 score of 6.5 reflects confidentiality risk with no integrity or availability impact, assuming the attacker already holds valid WordPress credentials.

Business impact

Data breach risk is the primary concern. Attackers with WordPress accounts (even low-privilege ones) can extract customer records, user credentials, private documentation, or other sensitive business information stored in the database. For organizations using BetterDocs to host proprietary technical documentation or internal wikis, unauthorized disclosure could expose architectural details, API keys, or confidential processes. The impact is contained to confidentiality—the flaw does not allow data modification or denial of service—but the threat increases if the site also stores regulated data (PII, PHI, PCI) that would trigger compliance incident response.

Affected systems

Any WordPress site running BetterDocs plugin version 4.6.0 or earlier AND with at least one of these active: WPML, Polylang, qTranslate, Weglot, or TranslatePress. If a site uses BetterDocs but has no multilingual plugin enabled, the vulnerable code path is not reachable and the site is not affected. Organizations should inventory BetterDocs deployments, check version numbers, and verify which multilingual plugins are enabled.

Exploitability

Exploitation requires valid WordPress authentication credentials and custom-level access or higher—a meaningful barrier, but not prohibitive. Many WordPress sites have looser role management, and custom user accounts for documentation editors or contributors may exceed the minimum privilege needed. An attacker must also have direct knowledge or discovery of the 'lang' parameter and its injection point. No public exploit code or detailed technical walkthrough is known to be in active circulation as of the publication date, but the vulnerability is straightforward SQL injection and would be trivial for a competent adversary with valid credentials. The conditional dependency on a multilingual plugin being active does limit the total attack surface.

Remediation

Update BetterDocs to the latest version above 4.6.0 as soon as the vendor releases a patch. Until then, mitigate by (1) disabling or removing the BetterDocs plugin if not actively in use, (2) temporarily deactivating all multilingual plugins to block the vulnerable code path (if operationally feasible), or (3) restricting WordPress user roles to prevent non-administrative accounts from accessing documentation editing features. Apply the principle of least privilege: audit existing user accounts and downgrade roles where possible.

Patch guidance

Monitor the BetterDocs plugin repository and the vendor's security advisory for version 4.6.1 or later. Verify compatibility notes before upgrading. Test the update in a staging environment first to ensure no functional regression with your multilingual setup. Once patched versions are available, schedule patching within 2–4 weeks given the MEDIUM severity and the requirement for authenticated access. Organizations with high-sensitivity data should prioritize sooner.

Detection guidance

Monitor WordPress access logs for POST/GET requests containing unusual SQL keywords ('UNION', 'SELECT', 'DROP', 'INSERT') in the 'lang' parameter or related query strings. Check application firewall (WAF) logs for SQL injection attempts. Review database query logs for unexpected UNION-based or stacked query patterns originating from authenticated WordPress sessions. Enable WordPress security plugins (e.g., Wordfence, Sucuri) to flag suspicious SQL strings in request logs. Audit WordPress user accounts with custom-level access or above to identify unexpected or dormant accounts that could be leveraged.

Why prioritize this

Although listed as MEDIUM severity with a CVSS score of 6.5, the vulnerability merits near-term attention because: (1) it affects a publicly available, widely used documentation plugin; (2) exploitation requires only existing credentials, not zero-day access; (3) the impact is confidentiality breach, which can be damaging in regulated or competitive environments; (4) the conditional gate (multilingual plugin active) is a common deployment pattern. Prioritize organizations with BetterDocs + multilingual setup and sensitive data in the database.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects: Network-accessible attack surface (AV:N), low attack complexity (AC:L), and requirement for low-privilege authentication (PR:L), resulting in a high confidentiality impact (C:H) with no integrity or availability impact (I:N, A:N). The 'low' privilege requirement—not 'none'—and the absence of integrity or availability risk prevent a higher score. The conditional nature of the exploit (multilingual plugin must be active) is not quantified in CVSS but lowers real-world risk for organizations without multilingual support enabled.

Frequently asked questions