The BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg WordPress plugin suffers from a missing capability check (CWE-862) in its get_response function. This flaw allows unauthenticated remote attackers to bypass authorization controls and access confidential information, including passwords protecting documents and metadata of private or draft content. The vulnerability affects all versions up to 4.1.1. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can gain unauthorized read access to sensitive information such as passwords for password-protected documents and metadata of private and draft documents. This exposure compromises confidentiality but does not affect data integrity or system availability. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin or disable it if possible to prevent unauthorized data disclosure. Monitor official channels from wpdevteam for updates and apply patches promptly once available.