CVE-2026-7515 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-7515 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-7515 is a Local File Inclusion (LFI) vulnerability in the BetterDocs Pro plugin for WordPress, affecting all versions up to and including 3.8.0, exploitable by unauthenticated attackers via the doc_style parameter.

Technical Detail

The flaw exists because the doc_style parameter is passed to a file inclusion function without adequate sanitization or path restriction, allowing an attacker to supply an arbitrary file path and cause the server to include local files. An unauthenticated attacker can exploit this by sending a crafted HTTP request containing a directory traversal sequence in the doc_style parameter, potentially reading sensitive files such as WordPress configuration files containing database credentials. Depending on server configuration and available writable paths, LFI vulnerabilities of this class can be escalated to remote code execution, particularly when combined with log poisoning or other file upload primitives.

Exploitation Status

No known exploit code has been publicly observed as of June 26, 2026. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit at this time, though the unauthenticated attack vector and critical CVSS score of 9.8 make this a high-priority target for opportunistic exploitation if proof-of-concept code becomes available.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability. Organizations running the affected plugin should not interpret the absence of attribution as reduced risk, given the unauthenticated nature of the attack surface.

What To Do

Update the BetterDocs Pro plugin to a version beyond 3.8.0 immediately. If a patched version is not yet available from the vendor, the plugin should be deactivated until a fix is released, as there is no viable workaround that preserves full plugin functionality while eliminating the attack surface. Detection efforts should focus on web server and application logs for requests containing directory traversal sequences such as ../ or encoded equivalents in the doc_style parameter. WordPress administrators should also audit wp-config.php access patterns and review file system permissions to limit the scope of any potential file read operations. Given the critical CVSS score and unauthenticated attack vector, patching should be treated as urgent and completed within 24 to 48 hours of a fix becoming available.