CVE-2026-4348 describes an SQL Injection vulnerability in BetterDocs Pro for WordPress, affecting all versions up to 3.7.0. The vulnerability exists because the `limit` POST parameter is directly interpolated into a SQL query before being passed to the `$wpdb->prepare()` function, which does not parameterize this input. This flaw allows unauthenticated attackers to inject arbitrary SQL commands via the `get_current_letter_docs` and `docs_sort_by_letter` AJAX actions, potentially extracting sensitive data from the database. The vulnerability is exploitable only if the Encyclopedia feature is enabled in the plugin settings. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, no privileges required, and no user interaction needed.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the WordPress database. The vulnerability does not allow modification or deletion of data (integrity and availability impacts are none), but confidentiality is highly impacted. Exploitation requires the Encyclopedia feature to be enabled in BetterDocs Pro.

No official patch or remediation guidance has been published by the vendor at this time. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, disabling the Encyclopedia feature in BetterDocs Pro settings may prevent exploitation. Avoid exposing the affected AJAX actions to untrusted users until a fix is available.