WordPress BetterDocs Pro SQL Injection via AJAX Parameters

The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the `get_current_letter_docs` and `docs_sort_by_letter` AJAX actions in all versions up to, and including, 3.7.0. This is due to the `limit` POST parameter being interpolated directly into a SQL query string before being passed to `$wpdb->prepare()`, which only parameterizes other variables. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The Encyclopedia feature must be enabled in BetterDocs Pro settings for the vulnerability to be exploitable.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The BetterDocs Pro plugin for WordPress contains a critical SQL injection vulnerability in its AJAX handlers that affects all versions through 3.7.0. Attackers can exploit the `limit` POST parameter in the `get_current_letter_docs` and `docs_sort_by_letter` AJAX actions by injecting malicious SQL code directly into database queries. Because this parameter is concatenated into the SQL string before parameterization occurs, attackers bypass WordPress's built-in protection mechanisms. This vulnerability is particularly dangerous because it requires no authentication, making it accessible to any unauthenticated user or bot scanning for vulnerable installations. WordPress sites running the affected plugin versions face immediate risk of data exfiltration, unauthorized modification, or complete database compromise.

Casky's 301 matching skills leverage Claude AI's extended reasoning to identify the attack patterns associated with TA0001 (Reconnaissance) and TA0043 (Resource Development) techniques mapped to this SQL injection. Practitioners using Casky will observe detection findings that highlight suspicious AJAX POST requests containing SQL syntax fragments in the `limit` parameter, unusual database query patterns in logs, and attempted UNION-based or time-based blind SQL injection payloads. The platform's CWE-89 mapping enables practitioners to correlate this vulnerability with broader input validation failures across their WordPress environment, pinpointing not just this plugin but similar coding patterns in custom themes and other extensions that may bypass prepared statements.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-4348.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-4348

Casky has 301 skills that investigate the attack patterns behind CVE-2026-4348. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn