CVE-2026-11371 BetterDocs CVE debrief

Who should care

Administrators and users of the BetterDocs WordPress plugin should be aware of this vulnerability and take immediate action to update to version 4.5.5 or later. This vulnerability has a high impact on administrators and users of the plugin, and they should review the affected scope and severity with the vendor. Defenders should verify the affected scope and severity with the vendor and implement additional security measures to prevent prompt injection attacks.

Technical summary

The BetterDocs WordPress plugin before 4.5.5 is vulnerable to prompt injection attacks due to improper sanitization of AI-generated documentation summaries. An unauthenticated user can inject malicious payload, which is then stored and outputted without proper sanitization. This can lead to the execution of malicious code in the browser of any visitor who views the affected page, including administrators. The vulnerability has a high impact on administrators and users of the BetterDocs WordPress plugin, and immediate action is required to update to version 4.5.5 or later. The plugin's feature that generates documentation summaries is exposed to unauthenticated users, allowing them to store malicious payload via prompt injection.

Defensive priority

High

Recommended defensive actions

• Update BetterDocs WordPress plugin to version 4.5.5 or later
• Monitor for suspicious activity on the affected pages
• Implement additional security measures to prevent prompt injection attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-16T07:16:46.480Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users. Defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Official resources