Technical impact
The exploit allows an authenticated user with subscriber-level access or higher to call the OpenAI API through the plugin’s "Write With AI" feature without any capability checks. This means the attacker can submit arbitrary prompts, causing the site’s stored OpenAI key to be used and charged. The consequence is unauthorized financial expense and potential exposure of content the site owner did not intend to share with the AI service. The weakness is a missing access control, classed as CWE‑862.
Affected Systems
Any WordPress site running the BetterDocs Knowledge Base plugin version 4.3.11 or earlier, including the 4.3.6 tag referenced in the code review. The vulnerability is present in the generate_openai_content_callback() function in the Core/WriteWithAI.php file.
Risk and Exploitability
The CVSS score is 4.3, indicating moderate severity. The EPSS score is below 1 %, suggesting the current exploitation likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. However, once a site has a valid OpenAI key and an authenticated subscriber account, the attacker can trivially trigger consumption by accessing the corresponding AJAX endpoint. The attack vector is expected to be via the normal WordPress admin interface or API calls that present a valid nonce but do not enforce capability checks.
