https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T16:42:49.734707+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-292853 EUVD-2026-292853 2026-10-12T16:42:49.777639+00:00 EUVD-2026-292853 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6393 fkie_cve-2026-6393 2026-10-12T16:42:49.777673+00:00

The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This is due to a missing capability check in the generate_openai_content_callback() function, which relies solely on a nonce rather than verifying user permissions. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger OpenAI API calls using the site's configured API key with arbitrary user-controlled prompts, leading to unauthorized consumption of the site owner's paid AI API quota.

 https://cve.radiocsirt.org/vuln/ghsa-hpvr-gqf8-j82g GHSA-hpvr-gqf8-j82g 2026-10-12T16:42:49.777709+00:00

The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This is due to a missing capability check in the generate_openai_content_callback() function, which relies solely on a nonce rather than verifying user permissions. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger OpenAI API calls using the site's configured API key with arbitrary user-controlled prompts, leading to unauthorized consumption of the site owner's paid AI API quota.