CVE-2025-14980: 
WordPress vulnerability analysis and mitigation

CVE-2025-14980 is a Sensitive Information Exposure vulnerability in the BetterDocs plugin for WordPress, affecting all versions up to and including 4.3.3. The flaw exists in the scripts() function, which inadvertently exposes sensitive configuration data — including stored OpenAI API keys — to authenticated users with contributor-level access or higher. It was published on January 9, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, NVD).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The root cause lies in the scripts() function of the BetterDocs plugin, which improperly includes sensitive plugin settings — such as the OpenAI API key — in data rendered or accessible to authenticated frontend users. An attacker with at minimum contributor-level WordPress access can trigger this function and extract the exposed credentials without any special configuration or elevated server-side privileges. No complex attack chain is required; the exposure is a direct result of insufficient access control on sensitive configuration data output (Wordfence, CleanTalk Research).

Successful exploitation allows an authenticated attacker to extract the OpenAI API key configured within the BetterDocs plugin settings, which could be used for unauthorized API consumption, incurring financial costs on the site owner, or enabling further abuse of the associated OpenAI account. The impact is limited to confidentiality — there is no direct integrity or availability impact on the WordPress installation itself. However, exposure of API credentials could facilitate secondary attacks, such as account takeover of the linked OpenAI account or abuse of AI-powered features (Wordfence, NVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14980. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the contributor level, which limits the attacker pool but does not eliminate risk on sites with open contributor registration. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, NVD).

1. Reconnaissance: Identify WordPress sites running the BetterDocs plugin version 4.3.3 or earlier using tools like WPScan or by inspecting page source for plugin-specific assets.
2. Obtain contributor access: Register or log in as a contributor-level (or higher) WordPress user on the target site. On sites with open registration, this may require only creating a free account.
3. Trigger the vulnerable function: Navigate to or craft a request that causes the scripts() function to execute — typically by visiting a page where BetterDocs scripts are enqueued (e.g., a documentation page).
4. Extract the API key: Inspect the page source or JavaScript variables rendered by the scripts() function to locate the OpenAI API key embedded in the plugin's configuration output.
5. Abuse extracted credentials: Use the harvested OpenAI API key to make unauthorized API calls, potentially incurring costs or accessing data associated with the site owner's OpenAI account (Wordfence, CleanTalk Research).

• Logs: WordPress access logs showing authenticated contributor-level users repeatedly accessing documentation pages or endpoints that load BetterDocs scripts, particularly from unfamiliar IP addresses.
• Network: Unusual outbound API calls to OpenAI endpoints (e.g., api.openai.com) originating from IP addresses not associated with the site's normal operations, potentially indicating stolen key usage.
• Application: Unexpected spikes in OpenAI API usage or billing alerts from the OpenAI account linked to the plugin's configured API key.
• File System: No direct file system indicators expected, as exploitation is passive (reading rendered page output) rather than file-based.

Site administrators should update the BetterDocs plugin to version 4.3.4 or later, which addresses this vulnerability by restricting sensitive data exposure in the scripts() function (WordPress Changeset). As an immediate precaution, administrators should rotate any OpenAI API keys stored in the plugin settings, even after patching, to invalidate any keys that may have already been exposed. Additionally, sites should review contributor-level user accounts and disable open user registration if not required (Wordfence).

Wordfence included CVE-2025-14980 in its weekly WordPress vulnerability report for January 5–11, 2026, noting the sensitive information exposure risk to sites using BetterDocs with OpenAI integration (Wordfence Blog). CleanTalk Research published a dedicated write-up on the vulnerability, providing additional technical context (CleanTalk Research). No significant broader media coverage or notable social media discussion has been identified beyond security community channels.