SQL Injection Vulnerability in Better Messages Plugin for WordPress

CVE-2026-93899

What is CVE-2026-93899?

The Better Messages plugin for WordPress, which facilitates chat functionalities, is susceptible to SQL Injection through the 'group_id' Message Meta Parameter across all versions up to 3.0.4. This vulnerability arises from inadequate escaping of user inputs and an improperly constructed SQL query. As a result, authenticated attackers with subscriber-level access can inject additional SQL commands, enabling them to extract sensitive database information. Notably, the exploitation of this vulnerability necessitates the presence of the BuddyBoss Platform plugin with its Social Groups feature disabled, which remains when sites previously deactivate the component.

References