CVE-2026-15104 is an SQL Injection vulnerability in the BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot WordPress plugin. The issue arises from improper neutralization of special elements in the 'lang' parameter, which is used in SQL queries without sufficient escaping or parameterization. Authenticated attackers with custom-level privileges or above can exploit this to append SQL commands and potentially extract sensitive database information. The vulnerable code path is only reachable if a supported multilingual plugin (WPML, Polylang, qTranslate, Weglot, or TranslatePress) is active, as checked by Helper::is_multilingual_active(). The vulnerability affects all plugin versions up to and including 4.6.0. No official patch or remediation guidance has been provided yet.

An attacker with authenticated custom-level access or higher can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact confidentiality, integrity, or availability beyond data disclosure. Exploitation requires a supported multilingual plugin to be active, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict custom-level user access where possible and monitor for suspicious activity related to the 'lang' parameter. Consider disabling the affected plugin or the multilingual plugin integration if feasible.