EUVD-2026-83478
GHSA-53vp-fjc5-cqj6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated remote header spoof (AV:N/AC:L/PR:N/UI:N); reading any user's private message history is C:H, posting into restricted rooms is I:L, no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the is_ai_bot_user() function identifying privileged internal AI bot accounts by performing a prefix check for 'ai-chat-bot-' against a guest record's stored IP address, which is populated verbatim from the client-controlled X-Real-IP request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters - which are all short-circuited by the bot check in user_can_join() and user_can_read() - to join administrator-restricted chat rooms, post messages into them, and read the private message history of other users.
AnalysisAI
Unauthenticated attackers can impersonate the Better Messages plugin's own internal AI bot accounts on WordPress sites running versions up to and including 2.15.33, gaining entry to administrator-restricted chat rooms and reading the private message history of other users. The flaw is entirely pre-authentication (CVSS vector PR:N/UI:N) and requires only that unauthenticated guest registration is enabled and that the server forwards the client-supplied X-Real-IP header to the plugin, which stores it verbatim; the plugin's is_ai_bot_user() check then prefix-matches the attacker-chosen value against 'ai-chat-bot-'. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication, user interaction, or special privileges required - remote exploitation works against default configurations wherever unauthenticated guest registration is enabled and the server passes the client-supplied X-Real-IP header through to the plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, describing a network-reachable, low-complexity, fully unauthenticated flaw requiring no user interaction - the exploitability metrics point to easy, remote, pre-auth abuse. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by upgrading the Better Messages plugin to version 3.0.0 or later; the upstream changeset comparing the 2.15.33 tag with 3.0.0 (https://plugins.trac.wordpress.org/changeset?old_path=bp-better-messages%2Ftags%2F2.15.33%2Finc%2Ffunctions.php&new_path=bp-better-messages%2Ftags%2F3.0.0%2Finc%2Ffunctions.php) documents the corrected code, so this is a vendor-released patch rather than an unconfirmed commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today