rootpwn

medium · CVSS v3 6.5 · EPSS 0.00399

CVE-2026-89334

An authorization bypass vulnerability exists in the Better Messages WordPress plugin up to version 2.15.33 due to improper privilege verific

Overview

An authorization bypass vulnerability exists in the Better Messages WordPress plugin up to version 2.15.33 due to improper privilege verification. The flaw allows authenticated users with custom-level access or higher to read unauthorized chat transcripts, thread metadata, and user data. This occurs when specific default chat room settings remain unconfigured.

Description

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.

Impact

Authenticated attackers can view sensitive private communications and user data across chat rooms without proper membership or authorization, leading to a breach of confidentiality. Organizations utilizing the affected plugin versions and default settings are at risk of data exposure. The integrity and availability of the system remain unaffected by this specific flaw.

Remediation

Update the Better Messages plugin to version 2.15.34 or higher immediately. Review and modify chat room configuration settings, specifically ensuring that the 'only_joined_can_read' setting is properly enforced rather than retaining its default value of '0'. Audit user roles and custom access levels to ensure principle of least privilege.

Risk context

The vulnerability carries a CVSS v3 score of 6.5, categorized as medium severity. The current EPSS score is 0.00399, indicating a low immediate exploitation probability in the wild, but defenders should still patch proactively given the exposure of private messages.

Affected products

  • Better Messages plugin for WordPress

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
0.00399

WordPress Plugin Authorization Bypass Privilege Escalation Information Disclosure Chat Defensive

← All CVEs

Related CVEs

medium

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) within its administrative settings. This vulnerability exists in all versions up to 2.4.12 due to inadequate input sanitization and output escaping of user-provided data.

View analysis

medium

CVE-2026-15660

The SEO Booster plugin for WordPress versions up to 7.4.7 suffers from a missing authorization check that allows any authenticated user with Subscriber role or higher to overwrite critical options. This can disrupt the Google Search Console integration and inject attacker‑supplied data into site options. The flaw is exploitable via a crafted /wp-admin/ URL that triggers the vulnerable handle_oauth_callback function.

View analysis

medium

CVE-2026-15760

The Divi Essential plugin for WordPress contains a vulnerability in its AJAX handlers that allows authenticated users to access sensitive database information. Due to missing authorization checks and bypassable security tokens, any user with Subscriber-level access can enumerate and read arbitrary database tables. This exposure includes critical data such as user credentials, session tokens, and site configuration settings.

View analysis

medium

CVE-2025-15698

The Business Name Generator plugin for WordPress, up to version 1.3, contains a vulnerability where configuration settings are not properly sanitized or escaped. This allows high-privileged users to inject malicious scripts into the application's database, which are then executed when the settings page is viewed.

View analysis