Better Messages <= 3.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure via Favorites Page
- ID
- WPSEC-2026-0123
- Plugin
- Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots (bp-better-messages)
- Affected
- from 2.12.9 before 3.0.12
- Remediation
- Update to 3.0.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Better Messages on WPSec AttackSurface
- Fix released
- Published
Description
The Better Messages plugin for WordPress is vulnerable to Sensitive Information Exposure via the getFavorited REST endpoint in all versions up to, and including, 3.0.11. When the requesting user had no starred messages, the handler passed an empty message list to get_messages(), which fell back to loading the latest messages of conversation ID 0, where the Bulk Messages preview feature stores its draft messages. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content of Bulk Messages previews created by administrators or other users allowed to send bulk messages.
References
- https://wpsec.com/vuln/WPSEC-2026-0123/
- https://plugins.svn.wordpress.org/bp-better-messages/tags/3.0.12/
- https://wordpress.org/plugins/bp-better-messages/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS