The BetterDocs plugin for WordPress contains a missing capability check in its get_response function, which allows unauthenticated users to retrieve the passwords of password‑protected documents as well as the metadata of private and draft documents. This flaw exposes confidential information that is normally restricted to authorized users.

WordPress installations that use the BetterDocs plugin version 4.1.1 or earlier are affected. The plugin is distributed by wpdevteam under the BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor. No other products or vendors are listed.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. The likely attack vector is a network request to the plugin’s REST endpoint that invokes get_response without verifying user capabilities. An unauthenticated attacker can send a legitimate HTTP request to this endpoint and receive the sensitive data in the response.