Description

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the BuddyBoss Platform plugin to be installed with its Social Groups component disabled, a state that persists on any site that has previously toggled the Groups component off since BuddyBoss does not drop the wp_bp_groups table upon deactivation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-25T07:16:56.500Z",
  "pubdate": "2026-09-25T07:16:56.500Z",
  "executiveSummary": "The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress contains a critical SQL injection vulnerability in versions up to and including 3.0.4.\nThe vulnerability originates from the improper sanitization and escaping of the 'group_id' parameter within the message meta-data handling logic.\nThis flaw allows authenticated users with at least subscriber-level privileges to perform arbitrary SQL command execution against the site database.\nSuccessful exploitation enables unauthorized actors to bypass standard database access controls, leading to the extraction of sensitive information or unauthorized data manipulation.\nThe vulnerability is dependent on a specific environment configuration where the BuddyBoss Platform plugin is installed and the 'Social Groups' component has been deactivated but the underlying 'wp_bp_groups' database table persists.\nThis creates an elevated risk profile for enterprise environments or community platforms utilizing BuddyBoss and Better Messages concurrently, as the attack vector remains active despite component deactivation.",
  "technicalDetails": "The vulnerability exists due to a failure in the application's data processing layer to adequately neutralize user-supplied input before passing it to database query execution functions. Specifically, the 'group_id' Message Meta Parameter is processed without sufficient escaping or the application of parameterized queries (prepared statements).\nThe root cause is identified as an implementation oversight where the 'group_id' parameter is directly concatenated into the SQL query string. This allows an attacker to terminate the intended query and append malicious SQL statements, effectively hijacking the database execution context.\nThe exploit flow begins with an authenticated attacker, holding a minimum of subscriber-level privileges, crafting a malicious request containing a manipulated 'group_id' parameter. By supplying a payload structured as a SQL injection sequence (e.g., using UNION SELECT or stacked queries), the attacker forces the database to process the appended instructions.\nThe technical precondition for this vulnerability is the presence of the BuddyBoss Platform plugin. The exploit relies on the existence of the 'wp_bp_groups' table. Even when the 'Social Groups' component in BuddyBoss is disabled, the table remains within the WordPress schema. The Better Messages plugin attempts to interact with this table structure, and the lack of robust input validation in the 'group_id' handling creates a pathway to execute unauthorized queries against the WordPress database.\nBecause the query is not prepared, the database engine executes the attacker-controlled code as part of the original query structure. This grants the attacker the ability to perform blind or error-based SQL injection, enabling the exfiltration of the entire database content, including user hashes, private messages, and metadata.\nPost-exploitation, an attacker can leverage the access to perform a full dump of the database tables, escalate privileges by modifying user roles within the wp_users table, or delete sensitive data, significantly compromising the integrity and confidentiality of the WordPress installation."
}