CVE-2026-89334mediumCWE-862

CVE-2026-89334: medium-severity vulnerability in wordplus Better Messages – Chat Rooms, Group…

Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint

Published 19 Sep 2026

Follow this CVE + Monitor Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.7%

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

wordplus · Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

Related CVEs — wordplus Better Messages – Chat Rooms, Group…

In the same product, most dangerous first.

CVE-2026-16585HIGHBetter Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' ParameterEPSS 1.2%CVE-2026-89093MEDIUMBetter Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/registerEPSS 0.3%CVE-2026-18555MEDIUMBetter Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' ParameterEPSS 0.3%CVE-2026-93899MEDIUMBetter Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta ParameterEPSS 0.3%CVE-2026-94376MEDIUMBetter Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display NameEPSS 0.2%

References