CVE-2026-4348: BetterDocs Pro WordPress SQLi Vulnerability

CVE-2026-4348 Overview

CVE-2026-4348 is an unauthenticated SQL injection vulnerability in the BetterDocs Pro plugin for WordPress. The flaw affects all versions up to and including 3.7.0. It exists in the get_current_letter_docs and docs_sort_by_letter AJAX actions, where the limit POST parameter is interpolated directly into a SQL query string before being passed to $wpdb->prepare(). Because $wpdb->prepare() only parameterizes the remaining variables, the injected limit value reaches the database engine unsanitized. The Encyclopedia feature must be enabled in BetterDocs Pro settings for the vulnerability to be exploitable.

Critical Impact

Unauthenticated attackers can append SQL queries to existing statements and extract sensitive data, including credentials and password hashes, from the WordPress database.

Affected Products

• BetterDocs Pro plugin for WordPress, all versions through 3.7.0
• WordPress sites with the Encyclopedia feature enabled in BetterDocs Pro settings
• WordPress installations exposing the admin-ajax.php endpoint to unauthenticated users

Discovery Timeline

• 2026-05-07 - CVE-2026-4348 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-4348

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] caused by unsafe string interpolation. The plugin builds a SQL statement that embeds the limit POST parameter directly into the query body. The developer then calls $wpdb->prepare() to bind other parameters, but prepare() does not retroactively sanitize values already concatenated into the query string. Attackers control the limit value through standard WordPress AJAX requests sent to admin-ajax.php with the action parameter set to get_current_letter_docs or docs_sort_by_letter.

Root Cause

The root cause is the misuse of $wpdb->prepare(). WordPress requires every dynamic value to be passed as a placeholder argument such as %d or %s. When the limit parameter is concatenated into the query template before prepare() runs, the function treats the injected SQL as part of the static query. This pattern bypasses parameter binding entirely for the affected variable.

Attack Vector

The attack vector is the network. An unauthenticated attacker sends a crafted POST request to wp-admin/admin-ajax.php containing a malicious limit payload. Typical payloads use UNION SELECT clauses to exfiltrate user records, session tokens, or option values. Time-based blind techniques are also viable when output is suppressed. Successful exploitation requires the Encyclopedia feature to be active in the plugin configuration.

No verified public exploit code is available at this time. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-4348

Indicators of Compromise

• POST requests to admin-ajax.php with action=get_current_letter_docs or action=docs_sort_by_letter containing SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK in the limit parameter.
• Unexpected database read errors or anomalous query latency originating from the wp_betterdocs_* code paths.
• Outbound traffic from the WordPress host carrying base64-encoded user records or password hashes shortly after suspicious AJAX activity.

Detection Strategies

• Inspect web server access logs for unauthenticated POSTs to admin-ajax.php referencing the two vulnerable actions, then correlate with non-numeric limit values.
• Deploy a web application firewall rule that blocks requests where the limit parameter contains anything other than digits.
• Monitor MySQL general or slow query logs for queries containing LIMIT followed by SQL syntax such as comments, subqueries, or UNION.

Monitoring Recommendations

• Forward WordPress, web server, and database logs to a centralized analytics platform such as Singularity Data Lake to enable cross-source correlation of injection attempts.
• Alert on spikes in admin-ajax.php traffic targeting BetterDocs actions from a single IP or autonomous system.
• Track unauthenticated requests that produce HTTP 500 responses, which often indicate failed injection probes.

How to Mitigate CVE-2026-4348

Immediate Actions Required

• Update BetterDocs Pro to a version later than 3.7.0 once the vendor publishes a fix; consult the BetterDocs Changelog for release status.
• Disable the Encyclopedia feature in BetterDocs Pro settings until a patched version is installed.
• Audit the wp_users, wp_usermeta, and wp_options tables for unauthorized reads and rotate any credentials that may have been exposed.

Patch Information

The vendor advisory tracks remediation through the BetterDocs Changelog. Site administrators should apply the next plugin release that explicitly addresses CVE-2026-4348 and verify the version after upgrade through the WordPress plugin manager.

Workarounds

• Block POST requests to admin-ajax.php where action equals get_current_letter_docs or docs_sort_by_letter at the WAF or reverse proxy layer.
• Enforce a numeric-only validation rule on the limit parameter using a request filtering module such as ModSecurity.
• Restrict access to the WordPress admin AJAX endpoint by IP allowlist where business requirements permit.

# Example ModSecurity rule to block non-numeric limit values targeting the vulnerable actions
SecRule ARGS:action "@rx ^(get_current_letter_docs|docs_sort_by_letter)$" \
    "id:1004348,phase:2,deny,status:403,chain,\
    msg:'CVE-2026-4348 BetterDocs Pro SQLi attempt'"
    SecRule ARGS:limit "!@rx ^[0-9]+$" "t:none"