The BetterDocs plugin for WordPress contains a classic SQL injection flaw in the 'lang' parameter. Versions up to and including 4.6.0 use the supplied value without proper escaping or preparation, inserting it directly into a database query. Because this code path is only executed when a multilingual plugin such as WPML, Polylang, qTranslate, Weglot, or TranslatePress is active, the vulnerability is gated by that requirement. An authenticated user with a custom‑level or higher capability can send a crafted 'lang' value that appends arbitrary SQL statements, enabling the attacker to read or modify database contents.

WordPress sites that install BetterDocs at or below version 4.6.0 and have one of the supported multilingual plugins active are affected. Only users who are logged in with custom‑level or higher privileges can exploit the flaw, making it an authenticated-only vulnerability.

The CVSS score of 6.5 marks the flaw as moderately severe, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because exploitation requires both an authenticated custom‑level user and an active multilingual plugin, the risk surface is narrower than for a public SQL injection, yet the potential impact—exfiltration of usernames, passwords, or other sensitive data—remains significant for affected sites.