Authorization Bypass in Better Messages Plugin for WordPress

CVE-2026-89334

What is CVE-2026-89334?

The Better Messages plugin for WordPress, which supports functionalities like chat rooms, group chat, and private messaging, is affected by a significant authorization bypass vulnerability. This issue arises from the plugin's failure to verify proper user authorization for specific actions, allowing authenticated users with custom-level access or higher to gain unauthorized access to sensitive chat-room data. If the default setting of 'only_joined_can_read' is maintained at '0', the risk escalates, exposing the full message transcripts, metadata, and user data of any thread within chat rooms. This poses a serious threat to user confidentiality and data integrity.

References