CVE-2026-89334

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 2.15.34

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with custom-level access or higher can access full message transcripts, thread metadata, and user data of any chat-room thread via the '/thread/' API endpoint. This issue is exploitable when the only joined can read setting of the chat room is set to its default value of '0'.

Recommendations Update the plugin to a version newer than 2.15.33. Change the only joined can read setting from '0' to restrict access to chat room threads.