CVE-2026-93899

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 3.0.5

Description An issue exists where authenticated users with subscriber-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of the user-supplied group id parameter and a lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to extract sensitive information from the database. Exploitation is possible if the BuddyBoss Platform plugin is installed and its Social Groups component is disabled, as the wp bp groups table remains in the database after deactivation.

Recommendations Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to version 3.0.5 or later.