CVE-2026-4348

The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the `get_current_letter_docs` and `docs_sort_by_letter` AJAX actions in all versions up to, and including, 3.7.0. This is due to the `limit` POST parameter being interpolated directly into a SQL query string before being passed to `$wpdb->prepare()`, which only parameterizes other variables. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The Encyclopedia feature must be enabled in BetterDocs Pro settings for the vulnerability to be exploitable.

• CWE-89

• https://betterdocs.co/changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5c0f02ad-f5f1-42b1-8116-e391aaa85430?source=cve

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43474In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43475In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43476In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-43477In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43478In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43479In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43480In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43481In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-43482In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43483In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43484In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43485In the Linux kernel, the following vulnerability has been re…5.5