The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the `is_ai_bot_user()` function identifying privileged internal AI bot accounts by performing a prefix check for `'ai-chat-bot-'` against a guest record's stored IP address, which is populated verbatim from the client-controlled `X-Real-IP` request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters — which are all short-circuited by the bot check in `user_can_join()` and `user_can_read()` — to join administrator-restricted chat rooms, post messages into them, and read the private message history of other users.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Wordplus |
|
| Wordpress |
|
No data.
No data.
References
History
Sun, 20 Sep 2026 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Wordplus
Wordplus better Messages – Chat Rooms, Group Chat, Private Messages & Ai Chat Bots Wordpress Wordpress wordpress |
|
| Vendors & Products |
Wordplus
Wordplus better Messages – Chat Rooms, Group Chat, Private Messages & Ai Chat Bots Wordpress Wordpress wordpress |
Sat, 19 Sep 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Sat, 19 Sep 2026 02:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the `is_ai_bot_user()` function identifying privileged internal AI bot accounts by performing a prefix check for `'ai-chat-bot-'` against a guest record's stored IP address, which is populated verbatim from the client-controlled `X-Real-IP` request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters — which are all short-circuited by the bot check in `user_can_join()` and `user_can_read()` — to join administrator-restricted chat rooms, post messages into them, and read the private message history of other users. | |
| Title | Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register | |
| Weaknesses | CWE-287 | |
| References |
|
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2026-09-19T02:27:11.997Z
Updated: 2026-09-19T14:01:26.022Z
Reserved: 2026-09-10T20:32:26.852Z
Link: CVE-2026-89093
Vulnrichment
Updated: 2026-09-19T13:56:38.764Z
NVD
Status : Deferred
Published: 2026-09-19T03:17:16.443
Modified: 2026-09-21T13:33:33.387
Link: CVE-2026-89093
Redhat
No data.