CVE-2026-7515: BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style
The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the docstyle parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the Local File Inclusion via the doc_style parameter by preventing upload of .php files to the site: configure WordPress and any upload handlers to reject .php file types (block .php uploads to the uploads directory) so attackers cannot upload .php files that might be included.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7515?
The severity of CVE-2026-7515 is rated as critical with a score of 9.8.
How do I fix CVE-2026-7515?
To fix CVE-2026-7515, update the BetterDocs Pro plugin to version 3.8.1 or later.
What type of vulnerability is CVE-2026-7515?
CVE-2026-7515 is a Local File Inclusion (LFI) vulnerability that allows remote code execution.
Which versions of BetterDocs Pro are affected by CVE-2026-7515?
BetterDocs Pro versions up to and including 3.8.0 are affected by CVE-2026-7515.
Can unauthenticated users exploit CVE-2026-7515?
Yes, unauthenticated attackers can exploit CVE-2026-7515 to execute arbitrary PHP code.