CVE-2026-89334

Received Received - Intake

Authorization Bypass in Better Messages WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-89334

Affected Vendors & Products

Vendor	Product	Version / Range
better_messages	better_messages	to 2.15.33 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in the Better Messages WordPress plugin. It allows authenticated attackers with custom-level access or higher to access private chat data, including full message transcripts, thread metadata, and user information, without proper authorization. The issue occurs when the chat room's default setting 'only_joined_can_read' is set to '0'.

Detection Guidance

This vulnerability can be detected by checking the version of the Better Messages plugin. If your version is 2.15.33 or lower, it is vulnerable. You can check the plugin version via WordPress admin dashboard under Plugins or by inspecting the plugin files on your server.

Impact Analysis

If you use this plugin, attackers could steal sensitive chat data, including private messages and user details. This could lead to privacy breaches, data leaks, or unauthorized access to confidential information shared in chat rooms.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the Better Messages plugin to the latest version. If an update is not available, consider disabling or removing the plugin until a patch is released. Review chat room settings to ensure only_joined_can_read is set to '1' to restrict access.

Hi! I’m here to help you understand CVE-2026-89334. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70