CVE-2026-16585

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 2.15.20

Description Insufficient file path validation in the delete sticker() function allows authenticated attackers with administrator-level access and above to delete arbitrary files on the server. This occurs because the normalize sticker() function uses esc url raw(), which fails to strip ../ traversal sequences. By crafting a URL that starts with the legitimate uploads base URL but includes these sequences, an attacker can bypass the prefix check intended to restrict deletions to the uploads directory. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations Update to a version newer than 2.15.19.