What the vulnerability does
01Description
The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This is due to a missing capability check in the generate_openai_content_callback() function, which relies solely on a nonce rather than verifying user permissions. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger OpenAI API calls using the site's configured API key with arbitrary user-controlled prompts, leading to unauthorized consumption of the site owner's paid AI API quota.
Explanation of Vulnerability in Simple Terms
02Summary
BetterDocs versions up to 4.3.11 lack proper authorization checks on certain operations. A logged-in user with low privileges can modify content they should not have access to. The vulnerability requires an active WordPress user account but no special interaction from other users.
What an attacker can do
03Attacker Capabilities
Modify or alter content in the knowledge base without proper permission checks.
Potential impact on your site
04Site Impact
Unauthorized users can alter knowledge base articles, FAQs, or documentation, potentially spreading misinformation or disrupting site content.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
April 24, 2026
CVE published
April 24, 2026
Record updated
