# BetterDocs <= 4.9.5 - Unauthenticated Open Redirect via MCP OAuth Authorization Endpoint

- **ID:** WPSEC-2026-2871
- **Plugin:** BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot (`betterdocs`), https://wordpress.org/plugins/betterdocs/
- **Affected versions:** from 4.9.0 before 4.9.6
- **Fixed in:** 4.9.6 (Update to 4.9.6 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-601
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/betterdocs
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2871/

## Description

The BetterDocs plugin for WordPress is vulnerable to Open Redirect via the MCP OAuth /authorize endpoint in all versions up to, and including, 4.9.5 due to insufficient validation of redirect targets. Anyone can register an OAuth client, and authorization errors were redirected to the client's registered redirect URI even when no user had ever approved that client. This makes it possible for unauthenticated attackers to redirect logged-in users who can edit docs to potentially malicious sites if they can successfully trick them into clicking a link. The MCP integration must be enabled, which it is not by default.

## References

- https://wpsec.com/vuln/WPSEC-2026-2871/
- https://plugins.svn.wordpress.org/betterdocs/tags/4.9.6/
- https://wordpress.org/plugins/betterdocs/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2871/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.