CVE-2026-93899 in Better Messages Plugin
Summary
by MITRE • 09/25/2026
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the BuddyBoss Platform plugin to be installed with its Social Groups component disabled, a state that persists on any site that has previously toggled the Groups component off since BuddyBoss does not drop the wp_bp_groups table upon deactivation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress contains a critical SQL injection vulnerability affecting all versions up to and including 3.0.4. This flaw stems from insufficient input validation and sanitization of the group_id parameter within the Message Meta functionality. The developer failed to properly escape user-supplied data before incorporating it into database queries, nor was prepared statement logic applied to mitigate this risk. As a result, authenticated attackers possessing subscriber-level access or higher can manipulate SQL query structures by injecting malicious code through the affected parameter. This allows for unauthorized extraction of sensitive information stored within the WordPress database, potentially exposing user credentials, private messages, and other confidential data depending on the specific privileges granted to the attacker's account role.
The exploitation of this vulnerability is contingent upon a specific configuration state involving the BuddyBoss Platform plugin. Specifically, attackers must have the Social Groups component disabled while ensuring that the wp_bp_groups table remains present in the database. This condition arises because BuddyBoss does not drop its associated tables when components are deactivated; instead, it merely disables functionality while retaining the underlying data structure. Consequently, any site where administrators have previously toggled off the Groups component retains the necessary schema elements for exploitation. This persistence of unused but accessible database structures creates a persistent attack surface that attackers can leverage even after administrative changes to plugin features.
From an industry standard perspective, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command. The lack of parameterized queries or proper escaping mechanisms directly facilitates the injection of arbitrary SQL commands into existing database operations. In terms of tactical classification under MITRE ATT&CK for Enterprise, this behavior corresponds to T1059, specifically command and script interpretation via SQL manipulation, allowing attackers to execute unauthorized data retrieval procedures. The attack vector is classified as Local Access with Low Privileges since it requires authentication but only basic subscriber-level permissions are necessary to initiate the exploit sequence against the vulnerable parameter.
The operational impact of this vulnerability extends beyond simple data leakage. Successful exploitation can lead to complete compromise of the WordPress database integrity if attackers escalate their privileges or extract administrative credentials stored within user tables. Furthermore, because the vulnerability relies on a specific interaction between two plugins, it may evade detection by security scanners that do not account for complex plugin dependencies and state persistence issues. Administrators relying solely on basic configuration checks might overlook this risk if they assume deactivating a feature removes all associated vulnerabilities. The presence of residual database tables from deactivated components represents a common oversight in WordPress ecosystem security management.
Mitigation strategies should prioritize immediate updates to version 3.0.5 or later, where the input handling for the group_id parameter has been corrected with proper escaping and prepared statement implementation. For sites unable to update immediately due to compatibility concerns, temporary workarounds include disabling the Better Messages plugin entirely until an upgrade is feasible. Additionally, administrators should audit their database schema to identify unused tables from deactivated plugins like BuddyBoss Social Groups and consider dropping them if they are no longer required for any active functionality. This reduces the attack surface by removing accessible structures that could be targeted in similar injection scenarios. Regular security audits focusing on plugin interactions and residual data artifacts will help prevent such state-dependent vulnerabilities from persisting in production environments.