CVE-2026-15104

Name of the Vulnerable Software and Affected Versions BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot versions prior to 4.6.1

Description An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of the user-supplied lang parameter and a lack of sufficient preparation on the existing SQL query. This allows attackers to append additional SQL queries to extract sensitive information from the database. Exploitation is only possible if a supported multilingual plugin (WPML, Polylang, qTranslate, Weglot, or TranslatePress) is active, as the vulnerable code path is gated by the is multilingual active() function.

Recommendations Update BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot to version 4.6.1 or later. As a temporary mitigation, disable the use of supported multilingual plugins until the update is applied.