Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89093— Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register

Quick assessment

Affected
wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Better Messages – 聊天室、群聊、私信及 AI 聊天机器人 插件在所有 2.15.33 及更早的版本中，存在通过身份伪造导致的信息泄露漏洞。 该漏洞的根本原因在于 函数通过检查访客记录中存储的 IP 地址是否以 为前缀，来识别具有特权的内部 AI 机器人账号。然而，这个 IP 地址是在未经身份验证的访客注册过程中，直接从客户端可控的 请求头中逐字填入的。 这使得未经身份验证的攻击者能够注册一个被插件视为其内部 AI 机器人的访客身份，从而绕过每个聊天室的允许角色列表、草稿状态

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1567.001 · Exfiltration to Code Repository
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89093

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
Source: CVE Program / CVE List V5
Vulnerability Description
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the `is_ai_bot_user()` function identifying privileged internal AI bot accounts by performing a prefix check for `'ai-chat-bot-'` against a guest record's stored IP address, which is populated verbatim from the client-controlled `X-Real-IP` request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters — which are all short-circuited by the bot check in `user_can_join()` and `user_can_read()` — to join administrator-restricted chat rooms, post messages into them, and read the private message history of other users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots 0 ~ 2.15.33 -

II. Public POCs for CVE-2026-89093

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89093

请登录查看更多情报信息。

Other References for CVE-2026-89093 (9)

IV. Related Vulnerabilities

Same product: Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Same vendor: wordplus
Same weakness: CWE-287

V. Comments for CVE-2026-89093

No comments yet

Leave a comment