CVE-2026-89093

Received Received - Intake

Better Messages Plugin Information Exposure via Spoofing

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the `is_ai_bot_user()` function identifying privileged internal AI bot accounts by performing a prefix check for `'ai-chat-bot-'` against a guest record's stored IP address, which is populated verbatim from the client-controlled `X-Real-IP` request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters — which are all short-circuited by the bot check in `user_can_join()` and `user_can_read()` — to join administrator-restricted chat rooms, post messages into them, and read the private message history of other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-89093

Affected Vendors & Products

Vendor	Product	Version / Range
better_messages	better_messages	to 2.15.33 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability in the Better Messages WordPress plugin allows unauthenticated attackers to spoof internal AI bot accounts by manipulating the X-Real-IP header during guest registration. The plugin checks for a specific prefix in the IP address to identify bots, which can be bypassed by attackers registering with a crafted IP address starting with 'ai-chat-bot-'. This grants access to restricted chat rooms and private message history.

Detection Guidance

Check WordPress plugin versions for Better Messages up to 2.15.33. Inspect server logs for unauthenticated guest registrations with AI bot prefixes in IP fields. Look for unusual chat room access or message posting by guest accounts.

Impact Analysis

If you use the Better Messages plugin, attackers could join private chat rooms, post unauthorized messages, and read private conversations of other users. This could lead to data leaks, reputational damage, or unauthorized access to sensitive information shared in chats.

Compliance Impact

This vulnerability could violate GDPR by exposing private user data without consent and HIPAA by allowing unauthorized access to protected health information if shared in chats. Organizations may face fines or penalties for failing to protect sensitive data under these regulations.

Mitigation Strategies

Update the Better Messages plugin to the latest version beyond 2.15.33. Disable guest registration if not required. Implement IP validation to prevent spoofing via X-Real-IP headers. Review chat room permissions and restrict administrator-only rooms.

Hi! I’m here to help you understand CVE-2026-89093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70