BetterDocs <= 4.9.5 - Unauthenticated Open Redirect via MCP OAuth Authorization Endpoint
- ID
- WPSEC-2026-2871
- Plugin
- BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot (betterdocs)
- Affected
- from 4.9.0 before 4.9.6
- Remediation
- Update to 4.9.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-601
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- BetterDocs on WPSec AttackSurface
- Fix released
- Published
Description
The BetterDocs plugin for WordPress is vulnerable to Open Redirect via the MCP OAuth /authorize endpoint in all versions up to, and including, 4.9.5 due to insufficient validation of redirect targets. Anyone can register an OAuth client, and authorization errors were redirected to the client's registered redirect URI even when no user had ever approved that client. This makes it possible for unauthenticated attackers to redirect logged-in users who can edit docs to potentially malicious sites if they can successfully trick them into clicking a link. The MCP integration must be enabled, which it is not by default.
References
- https://wpsec.com/vuln/WPSEC-2026-2871/
- https://plugins.svn.wordpress.org/betterdocs/tags/4.9.6/
- https://wordpress.org/plugins/betterdocs/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS