Vulnerability in Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots — CVE-2026-89334

What to do now

Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to 3.0.0 or later.

Affected versions

• Everything up to and including 2.15.33

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.

This description is reproduced verbatim from the public vulnerability record.

• https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.33/inc/functions.php#L3533
• https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.33/inc/functions.php#L3582
• https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.33/inc/functions.php#L3601
• https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.33/inc/rest-api.php#L181
• https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.33/inc/rest-api.php#L1964
• https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.33/inc/rest-api.php#L2598

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.