CVE-2026-15104: BetterDocs WordPress Plugin SQLi Flaw

CVE-2026-15104 Overview

CVE-2026-15104 is a SQL Injection vulnerability [CWE-89] in the BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress. All versions up to and including 4.6.0 are affected. The lang parameter is insufficiently escaped, and the surrounding SQL query lacks proper preparation. Authenticated users with custom-level access or above can append additional SQL statements to existing queries and extract sensitive database content. Exploitation requires a supported multilingual plugin — WPML, Polylang, qTranslate, Weglot, or TranslatePress — to be active, because the vulnerable code path is gated by Helper::is_multilingual_active().

Critical Impact
Authenticated attackers can exfiltrate arbitrary database records, including user credentials and session tokens, by injecting SQL through the lang parameter on multilingual WordPress sites.

Affected Products

BetterDocs plugin for WordPress, versions up to and including 4.6.0
WordPress installations running BetterDocs with WPML, Polylang, qTranslate, Weglot, or TranslatePress active
Sites where at least one account holds custom-level privileges or higher

Discovery Timeline

2026-07-10 - CVE-2026-15104 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15104

Vulnerability Analysis

The vulnerability lives in the BetterDocs PostType class, specifically the code paths at lines 767 and 819 of includes/Core/PostType.php in the 4.6.0 release. Both paths consume a client-supplied lang value and concatenate it into an SQL statement without using prepared parameters. The multilingual gate resides in Helper::is_multilingual_active() at line 344 of includes/Utils/Helper.php, which returns true when any supported translation plugin is detected.

The attacker must authenticate with at least custom-level access — a low bar on sites that allow contributor or subscriber-style roles with elevated capabilities. Because the injection sits in a query that returns document data, standard UNION-based or boolean-based techniques can reveal rows from any table the WordPress database user can read, including wp_users and wp_usermeta.

Root Cause

BetterDocs builds its language-filtered document query by string-concatenating the lang request parameter directly into the SQL text. The plugin relies on ad hoc escaping rather than $wpdb->prepare() placeholders, and the sanitization applied is insufficient to neutralize SQL metacharacters. The condition guarding the code path only checks whether a translation plugin is loaded, not whether the caller is trusted.

Attack Vector

An authenticated user issues an HTTP request to a BetterDocs endpoint that accepts the lang parameter. The attacker supplies a payload that closes the intended clause and appends a subquery or UNION SELECT. The database returns attacker-chosen columns in the response, enabling extraction of password hashes, secret keys, and configuration data. The attack requires network access, low privileges, and no user interaction.

No verified public exploit code is available at the time of publication. Technical detail on the vulnerable code paths is documented in the WordPress BetterDocs PostType Source and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-15104

Indicators of Compromise

Web server access logs showing requests containing lang= values with SQL metacharacters such as ', UNION, SELECT, --, or /*
BetterDocs REST or AJAX requests with unusually long lang parameter values or URL-encoded quotes (%27)
Repeated authenticated requests from a single low-privileged account to BetterDocs endpoints
Database error entries in debug.log referencing the BetterDocs document query context

Detection Strategies

Deploy a WAF rule that inspects the lang query parameter on BetterDocs endpoints and blocks SQL syntax tokens
Correlate authenticated WordPress sessions holding custom-level roles with anomalous query patterns against BetterDocs URLs
Baseline the volume of BetterDocs multilingual requests and alert on statistical deviations from a single user or IP

Monitoring Recommendations

Enable WordPress database query logging and alert on queries referencing wp_users originating from the BetterDocs code path
Forward web and application logs into a centralized data lake for retroactive hunting once new payloads are disclosed
Track privilege assignments and audit any custom role that grants capabilities beyond subscriber level

How to Mitigate CVE-2026-15104

Immediate Actions Required

Update the BetterDocs plugin to the version released in the fix changeset, which is above 4.6.0
Audit all WordPress accounts and revoke custom-level or higher access from users that do not require it
Rotate WordPress secret keys, administrator passwords, and any API tokens stored in the database if compromise is suspected
Review recent access logs for anomalous lang parameter values and quarantine suspected accounts

Patch Information

The vendor addressed the issue in the changeset published on WordPress.org. Refer to the BetterDocs Changeset Overview for the exact code modifications, which introduce parameterized queries for the lang value. The Wordfence Vulnerability Report confirms the fixed version and provides additional mitigation guidance.

Workarounds

Temporarily deactivate BetterDocs on sites running WPML, Polylang, qTranslate, Weglot, or TranslatePress until the patch is applied
Disable the multilingual plugin to close the Helper::is_multilingual_active() code path if BetterDocs must remain active
Restrict custom, contributor, author, and editor role assignments and enforce multi-factor authentication for all authenticated accounts
Deploy a virtual patch at the WAF that rejects requests containing SQL metacharacters in the lang parameter

bash

# Example ModSecurity rule to block SQL metacharacters in the lang parameter
SecRule ARGS:lang "@rx (?i)(union(\s|\+|/\*)+select|--|/\*|;|')" \
    "id:1026151041,\
     phase:2,\
     deny,\
     status:403,\
     msg:'CVE-2026-15104 BetterDocs lang SQLi attempt',\
     logdata:'lang=%{ARGS.lang}'"