CVE-2026-93899 wordplus CVE debrief

Who should care

Defenders managing WordPress environments with the Better Messages plugin and BuddyBoss Platform plugin should assess exposure and prioritize updates and monitoring. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and update the Better Messages plugin, assess exposure, and monitor for potential SQL injection attempts.

Why it matters

CVE-2026-93899 is a SQL injection vulnerability in the Better Messages WordPress plugin. Defenders should prioritize verification, updates, and monitoring to prevent potential data breaches.

• Authenticated attackers with subscriber-level access can extract sensitive database information
• SQL injection attempts may lead to data breaches
• Defenders must verify and update the Better Messages plugin
• Exposure assessment is required for WordPress environments with BuddyBoss Platform plugin

Technical summary

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via the 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerability allows authenticated attackers with subscriber-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Defensive priority

Defenders should prioritize verifying and updating the Better Messages plugin, assessing exposure in WordPress environments, and monitoring for potential SQL injection attempts.

Recommended defensive actions

• Verify and update the Better Messages plugin to the latest version
• Assess exposure in WordPress environments with the BuddyBoss Platform plugin
• Monitor for potential SQL injection attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in version 3.0.4 of the Better Messages plugin. The BuddyBoss Platform plugin's Social Groups component must be disabled for exploitation to be possible. The CVE record was published on 2026-09-25T07:16:56.500Z and has not been modified since then. The source details are limited, and defenders should verify the vulnerability and assess exposure in their WordPress environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.