CVE-2026-7515: BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style

Synopsis

Local File Inclusion in the BetterDocs Pro WordPress plugin (versions up to and including 3.8.0) allows an unauthenticated remote attacker to supply a crafted value to the `doc_style` parameter, causing the server to load and execute an arbitrary PHP file. No login or user interaction is required; the attacker only needs network access to the WordPress site. Successful exploitation enables full remote code execution, access-control bypass, and disclosure of sensitive server data. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a remediated release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable parameter is exposed over the network, so the attacker must be able to send HTTP requests to the WordPress site.

• AuthenticationNot required

  No account or session token is needed; the attack can be launched by any unauthenticated HTTP client.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; the exploit is fully self-contained.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions, memory-layout knowledge, or environmental dependencies are required to trigger the file inclusion.

Blast Radius

• Attacker executes arbitrary PHP code on the server, enabling full remote code execution and effective host compromise.
• Attacker reads any file accessible to the web-server process, including WordPress configuration files containing database credentials and secret keys.
• Attacker writes or modifies data by leveraging code execution, including altering database records, creating backdoor accounts, or defacing site content.
• Attacker crashes or destabilizes the WordPress service by executing resource-exhausting or destructive PHP payloads.