CVE-2025-14980 is a vulnerability classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) affecting the BetterDocs plugin for WordPress, versions up to and including 4.3.3. The flaw exists in the scripts() function, which improperly exposes sensitive data stored in the plugin's settings. Specifically, authenticated users with contributor-level access or higher can exploit this vulnerability to extract sensitive information such as the OpenAI API key configured within the plugin. The attack vector is network-based and requires low attack complexity, but the attacker must have at least contributor privileges, which means the vulnerability does not allow unauthenticated remote exploitation. The impact is primarily on confidentiality, as the attacker can access sensitive credentials that could be used to interact with OpenAI services or pivot to further attacks. There is no impact on integrity or availability. No user interaction is required for exploitation. The vulnerability has a CVSS v3.1 base score of 6.5, indicating a medium severity level. No public exploits are known at this time, and no official patches have been linked yet. The vulnerability was published in January 2026 and assigned by Wordfence. The exposure of API keys can lead to unauthorized API calls, potential data leakage, and increased attack surface if the keys are reused or have broad permissions.

For European organizations, the exposure of OpenAI API keys through this vulnerability can lead to unauthorized usage of AI services, resulting in unexpected costs, data leakage, or misuse of AI capabilities. Organizations relying on BetterDocs for knowledge base management and integrating OpenAI services are at risk of credential compromise. This could facilitate further attacks, including data exfiltration or lateral movement within the network if attackers leverage the API key to gather sensitive information or automate malicious tasks. The confidentiality breach may also violate GDPR requirements concerning the protection of sensitive data and credentials, potentially leading to regulatory penalties. Additionally, organizations with contributor-level users who are external collaborators or contractors face increased risk, as these users could exploit the vulnerability. The absence of impact on integrity and availability limits the scope to data confidentiality, but the sensitive nature of API keys elevates the concern. The lack of known exploits reduces immediate risk but does not eliminate the threat, especially as attackers may develop exploits once the vulnerability is publicly known.

1. Immediately audit and restrict contributor-level access to the BetterDocs plugin, limiting it only to trusted users. 2. Monitor and rotate OpenAI API keys stored in the plugin settings to invalidate any potentially compromised credentials. 3. Implement strict role-based access controls (RBAC) in WordPress to minimize the number of users with contributor or higher privileges. 4. Use web application firewalls (WAF) to detect and block suspicious requests targeting the scripts() function or related plugin endpoints. 5. Regularly review plugin updates from wpdevteam and apply patches promptly once available to address this vulnerability. 6. Consider isolating or sandboxing API keys with limited permissions to reduce the impact if exposed. 7. Conduct internal security awareness training for contributors about the risks of credential exposure and safe plugin usage. 8. Employ monitoring tools to detect unusual API usage patterns that may indicate compromised keys. 9. If feasible, temporarily disable or replace the BetterDocs plugin with alternative solutions until a patch is released. 10. Review and enhance logging and alerting mechanisms for plugin-related activities to quickly identify exploitation attempts.