CVE-2026-89334 in Better Messages Plugin
Summary
by MITRE • 09/19/2026
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The Better Messages plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions up to 2.15.33, classified under CWE-862 as Missing Authorization. This flaw stems from the application logic failing to properly verify that an authenticated user possesses the necessary permissions to access specific resources within chat room threads. While the vulnerability requires the attacker to have at least custom-level access and above, it allows for significant data exposure because the system does not enforce strict ownership or membership checks when retrieving sensitive information such as message transcripts, thread metadata, and associated user data.
The operational impact of this vulnerability is severe in environments where chat rooms are configured with the default setting only_joined_can_read set to zero. Under these conditions, any authenticated attacker meeting the minimum access threshold can bypass intended restrictions and retrieve the full history of conversations within a specific chat room thread. This includes private messages exchanged between users, which compromises confidentiality and violates privacy expectations inherent in messaging applications. The exposure extends beyond simple message content to include metadata that could reveal user relationships, activity patterns, and other sensitive contextual information about participants in the compromised threads.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate but insufficiently privileged credentials to access unauthorized data. It also relates to CWE-269, Improper Privilege Management, due to the failure in enforcing role-based access controls effectively during resource retrieval operations. The ability to extract full message transcripts without proper authentication checks represents a direct compromise of data integrity and confidentiality within the WordPress ecosystem.
To mitigate this risk, administrators should immediately update the Better Messages plugin to version 2.15.34 or later, where these authorization checks have been corrected. In cases where updating is not immediately feasible, applying a workaround by changing the only_joined_can_read setting from its default value of zero to one can restrict access so that only users who have explicitly joined the chat room can view messages. This configuration change ensures that even if an attacker has elevated custom-level permissions, they cannot exploit this specific logic flaw unless they are also members of the targeted chat thread. Regular security audits and monitoring for unusual data retrieval patterns should be implemented to detect potential exploitation attempts in real-time.