BP Better Messages CVE-2026-32547

No authentication is required - the injection point is reachable by any unauthenticated visitor to the WordPress site (PR:N confirmed by CVSS vector). The critical limiting factor is UI:R: successful exploitation requires that a logged-in user (ideally one with elevated WordPress privileges such as an editor or administrator) actively views the attacker's submitted content, such as opening a message thread or accessing a message moderation queue. The plugin must be installed and active on the WordPress site. Exploitation is not constrained by any non-default configuration or special server-side setting based on available data. What limits impact: the attacker cannot trigger execution autonomously - they must wait for a victim to interact with the crafted content; and the C:L/I:L/A:L impact metrics cap the per-session impact, though privilege escalation via stolen admin cookies extends the realistic blast radius considerably.

The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a meaningful real-world threat: the attack is network-reachable, requires no authentication, and has low complexity - only user interaction (UI:R) prevents a fully automated attack. The scope change elevates severity because XSS payloads running in an admin's browser can leverage that session context to perform privileged WordPress actions. No EPSS score was provided in the input data; without it, exploitation probability cannot be quantified precisely. The absence of a CISA KEV listing and no reported POC reduces immediate urgency compared to actively weaponized XSS vulnerabilities, but unauthenticated XSS in messaging plugins is a well-understood attack class frequently exploited in WordPress-targeting campaigns. The C:L/I:L/A:L impact ratings appear modestly scored relative to the potential for full admin compromise via session token theft - defenders should treat the realistic impact as higher than the individual metric values suggest if administrative users interact with attacker-submitted messages.

An unauthenticated attacker visits the WordPress site, locates the BP Better Messages interface, and submits a message containing a crafted JavaScript payload (e.g., a script that exfiltrates document.cookie to an attacker-controlled endpoint). When a logged-in administrator or privileged user views or moderates that message in the WordPress dashboard or front-end messaging view, the script executes in their browser session, capturing their session cookie and transmitting it to the attacker. The attacker then replays the session token to gain administrative access to the WordPress site. No public proof-of-concept code has been identified, but this attack pattern requires no specialized tooling beyond a browser.