Better Messages EUVD-2026-83475

Requires an authenticated WordPress account at 'custom-level access and above' (PR:L) - not a truly unauthenticated attack despite the description's wording. Exploitation is further gated on the target chat room's only_joined_can_read setting retaining its default value of '0'; rooms reconfigured to '1' (only joined members can read) are not exploitable. Impact is confined to disclosure (message transcripts, thread metadata, participant user data); there is no integrity or availability impact and no user interaction is needed. Applies to Better Messages plugin versions up to and including 2.15.33 on WordPress.

This is a real but moderate-priority confidentiality issue rather than a critical emergency. The vendor CVSS 3.1 vector (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) and no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with the CWE-862 broken-access-control description that lets an authenticated 'custom-level' user read any chat thread. No EPSS score, KEV listing, POC, or SSVC decision data is present in the input, so exploitation probability and automatability cannot be quantified. Exploitation status is therefore 'no public exploit identified at time of analysis'; this must not be read as safe, since the underlying flaw (missing membership check on documented REST endpoints) is trivial to weaponize once a low-privilege account is obtained. NOTE a description/CVSS conflict: the text says access is possible 'without authentication' yet the CVSS vector is PR:L and the same sentence says 'authenticated attackers, with custom-level access and above' - the vector and the majority of the wording indicate an AUTHENTICATED authorization bypass, so the 'without authentication' phrasing is best read as 'without being a member of the thread,' not truly unauthenticated. A further limiting signal: the description explicitly gates exploitation on the room's only_joined_can_read setting retaining its default '0'.

An attacker registers or obtains a low-privilege 'custom-level' account on a WordPress site running Better Messages, then calls the plugin's REST endpoints referencing an arbitrary chat-room thread ID they do not belong to. Because the handler never verifies thread membership (and the room keeps the default only_joined_can_read='0'), the server returns the full message transcript, thread metadata, and participant user data. No public exploit code is identified at time of analysis, but the flaw is low-complexity and requires no user interaction.