CVE Intelligence
Analysis AI-assisted

CVE-2026-7515: BetterDocs Pro WordPress Plugin Local File Inclusion Vulnerability

CVE-2026-7515 affects the BetterDocs Pro plugin for WordPress in versions up to and including 3.8.0, through the doc_style parameter. The record describes a Local File Inclusion issue that can be reached without authentication and carries a CVSS 3.1 base score of 9.8 from the CNA Wordfence. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7515 is a Local File Inclusion issue in the BetterDocs Pro plugin for WordPress. According to the record, the flaw is reachable through the doc_style parameter. The CNA mapped the issue to CWE-98, which is named PHP Remote File Inclusion, a naming difference discussed in the limitations section.

Impact

  • The record states that unauthenticated attackers could include and execute arbitrary .php files on the server.
  • Consequences listed in the record include bypassing access controls, obtaining sensitive data, and executing code where .php files can be uploaded and included.
  • The CVSS 3.1 base score of 9.8 (Critical) reflects the vector in the record, which indicates network access, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity and availability.

Affected products and versions

  • Product: BetterDocs Pro plugin for WordPress.
  • Affected versions: up to and including 3.8.0, as stated in the record description.
  • Fixed versions: none are listed in the record. A missing fixed version does not mean no fix exists, so vendor communications should be checked.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog.
  • No confirmed active exploitation appears in the sources consulted for this analysis.
  • No EPSS score is present in the record.

Remediation and mitigation

  • Inventory all WordPress sites running BetterDocs Pro and confirm the installed version.
  • Plan an update to a release later than 3.8.0. This is an inference from the stated range; confirm the fixed release with the BetterDocs changelog.
  • If an update cannot be applied immediately, consider deactivating the plugin where it is not essential and restricting access to administrative and file-handling features.
  • Review whether PHP files can be uploaded to locations that the application might include, and tighten upload restrictions.
  • Keep WordPress core, themes and other plugins up to date.

Detection guidance

  • Review web server and application logs for unusual requests that use the doc_style parameter, particularly from unauthenticated sources.
  • Monitor for unexpected PHP files in upload or plugin directories and for recently modified files.
  • Watch for unexpected administrative accounts or outbound connections that follow suspicious requests.

Limitations of the available information

  • The record gives no affected version range below the 3.8.0 upper bound and no fixed version.
  • The description calls the issue Local File Inclusion, while the CWE is PHP Remote File Inclusion. The record does not explain the exact mechanism.
  • No technical advisory details, proof of concept or exploitation telemetry are included in the record.
  • EPSS and SSVC data are missing.

Frequently asked questions

Which BetterDocs Pro versions are affected by CVE-2026-7515?

The record states that versions up to and including 3.8.0 are affected. It does not list a fixed version, so check the vendor changelog for the release that addresses the issue.

Is CVE-2026-7515 being actively exploited?

The record does not list the CVE in CISA KEV, and no confirmed active exploitation appears in the sources consulted. Organizations should still treat the critical CVSS score as a reason to patch promptly.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.