The BetterDocs Pro plugin for WordPress is vulnerable to SQL injection through the AJAX actions get_current_letter_docs and docs_sort_by_letter. A POST parameter named limit is concatenated directly into a SQL query string before being passed to $wpdb->prepare(), which only parameterizes other variables. An unauthenticated attacker can append additional SQL statements, enabling extraction of sensitive database information. The flaw is only exploitable when the Encyclopedia feature is enabled in the plugin settings.

The affected product is the BetterDocs Pro plugin for WordPress, versions up to and including 3.7.0. Any WordPress installation that has installed or upgraded to a vulnerable version of this plugin and has the Encyclopedia feature enabled is at risk.

The vulnerability carries a CVSS score of 7.5, indicating a high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Because the flaw requires no authentication and can be triggered through ordinary HTTP POST requests to the AJAX endpoints, an attacker does not need to gain any privileged access. Successful exploitation would allow the attacker to read arbitrary data from the database, potentially exposing sensitive user information.