CVE-2026-15104 is a SQL Injection vulnerability in the BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot WordPress plugin. The issue exists in all versions up to and including 4.6.0 due to improper neutralization of special elements in the 'lang' parameter. Exploitation requires that a supported multilingual plugin (WPML, Polylang, qTranslate, Weglot, or TranslatePress) is active, as the vulnerable code path is gated by Helper::is_multilingual_active(). Authenticated attackers with custom-level access or higher can inject additional SQL queries to extract sensitive data from the database. No official patch or remediation guidance is currently provided.

An authenticated attacker with custom-level access or higher can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. Exploitation requires the presence of a supported multilingual plugin, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with custom-level permissions or higher and monitor for suspicious activity related to the 'lang' parameter. Consider disabling the plugin or the multilingual feature if feasible to reduce exposure.