{"data":{"id":"14bc5b51-a4df-4ab5-93e2-0ba31b14800f","title":"CVE-2026-6393: The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This…","summary":"CVE-2026-6393 affects the BetterDocs plugin for WordPress in versions up to and including 4.3.11. The generate_openai_content_callback() function lacks a capability check and relies only on a nonce, so authenticated users with subscriber-level access and above can trigger OpenAI API calls with arbitrary prompts. Each call uses the site's configured API key, consuming the site owner's paid AI API quota.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6393","publishedAt":"2026-04-24T04:16:22.607Z","cveId":"CVE-2026-6393","cweIds":["CWE-862"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenAI API","BetterDocs generate_openai_content feature"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"BetterDocs WordPress plugin missing authorization in OpenAI content generation","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.0027,"epssCheckedAt":"2026-11-10T00:11:23.585Z","kevDateAdded":null,"advisoryAliases":["GHSA-hpvr-gqf8-j82g"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T12:11:05.869Z","patchAvailable":null,"disclosureDate":"2026-04-24T04:16:22.607Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}