Better Messages CVE-2026-93899

Requires an authenticated account at subscriber level or above (PR:L) on the target WordPress site. Critically, it also requires a specific deployment state: the BuddyBoss Platform plugin must be installed AND its Social Groups component disabled, with the wp_bp_groups table still present (which persists on any site that previously toggled Groups off, since BuddyBoss does not drop the table on deactivation). Against a default Better Messages install with no BuddyBoss, or with BuddyBoss Groups still active, the vulnerable code path is not reachable - this configuration dependency is the primary limiting factor and substantially narrows the exploitable population.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 Medium) frames this as a network-reachable, low-privilege SQL injection with high confidentiality impact and no integrity/availability effect - consistent with CWE-89 data-exfiltration-only. However, the raw score understates the real-world gating: exploitation is NOT possible against a default Better Messages install. The description imposes a compound precondition - the BuddyBoss Platform plugin must be installed AND its Social Groups component disabled while the wp_bp_groups table persists - which the AC:L metric does not capture; a more honest reading is AC:H because the attacker does not control this site configuration. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis.' Wordfence (the reporter) confirms the flaw and the trac changeset confirms a fix in 3.0.5. Net assessment: a genuine authenticated SQLi worth patching, but real-world priority is LOWER than the 6.5 suggests because subscriber-level auth is required AND a specific two-plugin, non-default configuration must exist. Treat as a moderate, config-dependent issue rather than a broad emergency.

On a WordPress site running both Better Messages (≤3.0.4) and BuddyBoss Platform with the Social Groups component toggled off (leaving the wp_bp_groups table intact), an attacker registers a low-privilege subscriber account, then sends a crafted message-meta request injecting SQL through the unescaped 'group_id' parameter to append queries and read sensitive database contents such as user credentials or hashes. No public exploit code is identified at time of analysis, though the vulnerable code paths are pinpointed in the Wordfence advisory and plugin trac source.