CVE-2026-16585
Received Received - Intake

Arbitrary File Deletion in Better Messages WordPress Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-16585
EUVD
EUVD-2026-49697

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
better_messages better_messages to 2.15.19 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Better Messages WordPress plugin. It allows authenticated attackers with administrator access to delete arbitrary files on the server due to insufficient file path validation in the delete_sticker function. Attackers can bypass security checks by crafting URLs with directory traversal sequences, enabling them to delete critical files like wp-config.php, which could lead to remote code execution.

Detection Guidance

Check for unauthorized file deletions in WordPress uploads directories. Inspect server logs for suspicious requests targeting the delete_sticker function. Look for unusual activity from administrator-level accounts.

Impact Analysis

If exploited, this vulnerability can lead to complete server compromise. Attackers could delete essential files, disrupt services, or gain control over the WordPress site. Since it requires administrator access, the risk is highest for sites where unauthorized users have gained admin privileges.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR and HIPAA requirements for data protection and integrity. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Update the Better Messages plugin to the latest version. Remove administrator-level access for unnecessary users. Monitor file system changes and restrict write permissions to critical files like wp-config.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16585. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart