Better Messages <= 3.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure of Hidden Chat Room Participants via 'getChatRooms' REST Endpoint
- ID
- WPSEC-2026-0124
- Plugin
- Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots (bp-better-messages)
- Affected
- all versions before 3.0.12
- Remediation
- Update to 3.0.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Better Messages on WPSec AttackSurface
- Fix released
- Published
Description
The Better Messages plugin for WordPress is vulnerable to Sensitive Information Exposure via the getChatRooms REST endpoint in all versions up to, and including, 3.0.11. The endpoint returned the member IDs and member counts of every chat room it listed without honouring the room's 'Hide participants list' and 'Hide participants count' settings, which the conversation view enforces for non-moderators. This makes it possible for authenticated attackers, with subscriber-level access and above, to list the members of chat rooms they are allowed to join whose participant list is hidden. Unauthenticated visitors can do the same for rooms that list Guests among the roles allowed to join.
References
- https://wpsec.com/vuln/WPSEC-2026-0124/
- https://plugins.svn.wordpress.org/bp-better-messages/tags/3.0.12/
- https://wordpress.org/plugins/bp-better-messages/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS