The BetterDocs WordPress plugin is vulnerable in all releases up to 4.3.3 via the scripts() function. An authenticated attacker with contributor or higher privileges can read plugin settings, including the OpenAI API key. This allows the attacker to gain access to proprietary credentials and potentially use the key for unauthorized API calls, leading to data leakage and misuse of accounts.

WordPress sites that have installed the BetterDocs plugin from wpdevteam up to and including version 4.3.3 are affected. All users of the plugin within those versions who have contributor-level or higher permissions can exploit the flaw.

The CVSS score of 6.5 ranks this vulnerability as moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Attackers require only authenticated access at the contributor level, a role commonly granted to content editors, which makes the attack vector relatively straightforward for insiders or compromised accounts, but the low EPSS suggests active exploitation has not been observed.