Information Exposure in Better Messages Plugin for WordPress

CVE-2026-89093

What is CVE-2026-89093?

The Better Messages plugin for WordPress is susceptible to a significant information exposure vulnerability due to improper validation of user identities. This weakness arises from the is_ai_bot_user() function, which allows unauthenticated users to manipulate guest registration by submitting their IP address in the X-Real-IP header. Consequently, attackers can masquerade as internal AI bot accounts, bypassing crucial authorization checks such as room access restrictions and message visibility controls. This flaw potentially grants unauthorized access to sensitive chat rooms and private message histories, compromising user privacy and data integrity.

References