Server-Side Request Forgery in Better Messages Plugin for WordPress

CVE-2024-13697

Summary

The Better Messages plugin for WordPress, which supports features like live chat and user engagement through platforms like BuddyPress and BuddyBoss, has a vulnerability that allows Server-Side Request Forgery (SSRF). This flaw exists in all versions up to and including 2.7.4, where the parameter 'nice_links' can be exploited. An attacker without authentication may exploit this vulnerability to send web requests to internal services, enabling them to fetch or manipulate sensitive information. The risk is aggravated when the 'Enable link previews' option is turned on, as it is by default, highlighting the need for users to promptly update their plugin to safeguard against unauthorized access.

References