ZeroDay Findings
Sign inSign up

Findings

CVE-2026-4348

The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the and AJAX actions in all versions up to, and including, 3.7.0.

Published May 7, 2026 · updated Jun 17, 2026

The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the and AJAX actions in all versions up to, and including, 3.7.0. This is due to the POST parameter being interpolated directly into a SQL query string before being passed to , which only parameterizes other variables. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The Encyclopedia feature must be enabled in BetterDocs Pro settings for the vulnerability to be exploitable.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 7, 2026 · NIST NVD

    Detected

    The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the and AJAX actions in all versions up to, and including, 3.7.0. This is due to the POST parameter being interpolated directly into a SQL query string before being passed to , which only parameterizes other variables. This makes it possible for unauthenticated attackers to append additional SQL queries into already existin

  2. Jun 17, 2026 · NIST NVD

    Updated

    The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the and AJAX actions in all versions up to, and including, 3.7.0. This is due to the POST parameter being interpolated directly into a SQL query string before being passed to , which only parameterizes other variables. This makes it possible for unauthenticated attackers to append additional SQL queries into already existin

Sources

  • CVE.orgVulnerability recordCVE-2026-4348

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-4348

    The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the and AJAX actions in all versions up to, and including, 3.7.0. This is due to the POST parameter being interpolated directly into a SQL query stri

    nvd.nist.gov

References