[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fl8UhttLbtErS1bL0VYvkCSGRHZyDDWAKNHS1n6fGHG8":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-42736","better-messages-chat-rooms-group-chat-private-messages-ai-chat-bots-unauthenticated-insecure-direct-object-reference","Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots \u003C= 2.14.16 - Unauthenticated Insecure Direct Object Reference","The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.14.16 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.","bp-better-messages",null,"\u003C=2.14.16","2.15.0","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-05-27 00:00:00","2026-06-02 12:07:01",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fbe23d61f-1e7f-40fb-88ca-dd0ed226a7c5?source=api-prod",7,[22,23,24,25,26,27,28,29],"addons\u002Fai\u002Fai.php","addons\u002Fai\u002Fapi\u002Fanthropic.php","addons\u002Fai\u002Fapi\u002Fgemini.php","addons\u002Fai\u002Fapi\u002Fopen-ai.php","addons\u002Fai\u002Fapi\u002Fprovider-interface.php","addons\u002Fbuddypress.php","addons\u002Ffiles.php","addons\u002Ffluent-community\u002Ffluent-community-spaces.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-42736 (Better Messages IDOR)\n\n## 1. Vulnerability Summary\nThe **Better Messages** plugin (up to 2.14.16) contains an **Insecure Direct Object Reference (IDOR)** vulnerability in its AI Addon's REST API callback handling. The vulnerability exists because an unauthenticated REST endpoint, designed to receive callbacks from the \"Better Messages Cloud AI\" service, fails to properly validate a \"key\" parameter provided by the user. An attacker can provide an arbitrary `message_id` and a dummy `key` to trigger internal actions, such as overwriting message translations or metadata, without authentication.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `POST \u002Fwp-json\u002Fbetter-messages\u002Fv1\u002Fcloud-ai\u002Fcallback`\n- **Authentication:** Unauthenticated (REST `permission_callback` returns `true`).\n- **Vulnerable Parameter:** `key` (used for authorization but not validated) and `message_id` (the object reference).\n- **Action Type:** `translate` (and potentially others like `moderate` or `transcribe`).\n- **Preconditions:** The AI module must be active (usually requires PHP 8.1+ as seen in `addons\u002Fai\u002Fai.php`).\n\n## 3. Code Flow\n1. **Route Registration:** In `Better_Messages_AI::rest_api_init` (located in `addons\u002Fai\u002Fai.php`), a REST route is registered: `\u002Fbetter-messages\u002Fv1\u002Fcloud-ai\u002Fcallback`.\n2. **Request Handling:** The handler for this route (e.g., `cloud_ai_callback`) accepts a JSON payload containing `action`, `message_id`, and `key`.\n3. **Flawed Validation:** The code checks if a `key` is present in the request but fails to verify that this `key` matches the site's secret `cloudAiKey` or a specific job token.\n4. **Action Trigger:** Based on the `action` parameter (e.g., `translate`), it triggers the WordPress action `better_messages_cloud_ai_translate_result` via `do_action()`.\n5. **Sink:** The function `Better_Messages_AI::handle_translate_callback( $message_id, $data )` (hooked at `addons\u002Fai\u002Fai.php:122`) is executed.\n6. **Data Modification:** `handle_translate_callback` uses `Better_Messages()->functions->update_message_meta()` to store the \"translated\" text provided in the request payload into the database for the specified `message_id`.\n\n## 4. Nonce Acquisition Strategy\nThe targeted REST endpoint `\u002Fwp-json\u002Fbetter-messages\u002Fv1\u002Fcloud-ai\u002Fcallback` is designed for server-to-server communication and typically uses the `permission_callback => '__return_true'` pattern, meaning **no WordPress nonce is required** for the exploit.\n\n## 5. Exploitation Strategy\nThe goal is to modify the content (translation) of a private message.\n\n### Step 1: Identify a Target Message\nUse WP-CLI to find a valid message ID in the system.\n```bash\nwp db query \"SELECT id FROM wp_bp_messages_messages LIMIT 1\"\n```\n\n### Step 2: Perform the Injection\nSend a specially crafted POST request to the callback endpoint.\n\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fbetter-messages\u002Fv1\u002Fcloud-ai\u002Fcallback`\n- **Method:** `POST`\n- **Headers:** `Content-Type: application\u002Fjson`\n- **Payload:**\n```json\n{\n  \"action\": \"translate\",\n  \"message_id\": [TARGET_MESSAGE_ID],\n  \"key\": \"anything\",\n  \"result\": {\n    \"translation\": \"ATTACKER_CONTROLLED_TEXT_OVERWRITE\",\n    \"language\": \"en\"\n  }\n}\n```\n\n## 6. Test Data Setup\n1. **Ensure AI Addon is Loaded:** The plugin requires PHP 8.1+ for the AI component to initialize (`addons\u002Fai\u002Fai.php:24`).\n2. **Enable AI Translation:**\n   ```bash\n   # Settings are stored in a serialized array in the options table\n   wp option get bp-better-messages-settings --format=json > settings.json\n   # Ensure \"aiTranslationEnabled\" is set to \"1\" in the JSON and update\n   wp option update bp-better-messages-settings --format=json \u003C settings.json\n   ```\n3. **Create a Test Message:**\n   Use a subscriber account to send","The Better Messages plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via its AI Addon's REST API callback endpoint. The vulnerability allows unauthenticated attackers to manipulate message metadata and translations for arbitrary message IDs because the endpoint fails to validate a user-controlled 'key' against a site secret.","\u002F\u002F addons\u002Fai\u002Fai.php (within rest_api_init method)\nregister_rest_route('better-messages\u002Fv1', '\u002Fcloud-ai\u002Fcallback', array(\n    'methods' => 'POST',\n    'callback' => array( $this, 'cloud_ai_callback' ),\n    'permission_callback' => '__return_true',\n));\n\n---\n\n\u002F\u002F addons\u002Fai\u002Fai.php (inferred implementation of cloud_ai_callback)\npublic function cloud_ai_callback( WP_REST_Request $request )\n{\n    $params = $request->get_json_params();\n\n    if ( ! isset( $params['key'] ) ) {\n        return new WP_Error( 'rest_forbidden', __( 'Forbidden', 'bp-better-messages' ), array( 'status' => 403 ) );\n    }\n\n    \u002F\u002F The vulnerability: The code checks for the existence of 'key' but fails to verify if its value matches the secret cloudAiKey\n    $action = $params['action'];\n    $message_id = $params['message_id'];\n    $result = $params['result'];\n\n    do_action( 'better_messages_cloud_ai_' . $action . '_result', $message_id, $result );\n\n    return array( 'success' => true );\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbp-better-messages\u002F2.14.16\u002Faddons\u002Fai\u002Fai.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbp-better-messages\u002F2.15.0\u002Faddons\u002Fai\u002Fai.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbp-better-messages\u002F2.14.16\u002Faddons\u002Fai\u002Fai.php\t2026-04-07 08:11:34.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbp-better-messages\u002F2.15.0\u002Faddons\u002Fai\u002Fai.php\t2026-04-30 06:15:22.000000000 +0000\n@@ -50,6 +50,7 @@\n                 add_action( 'better_messages_before_message_delete', array( $this, 'before_delete_message' ), 10 , 3 );\n \n                 add_action( 'bp_better_messages_new_thread_created', array( $this, 'on_new_thread_created'), 10, 2 );\n+                add_filter( 'better_messages_ai_bot_instruction', array( $this, 'apply_placeholders_to_instruction' ), 10, 3 );\n                 add_filter( 'better_messages_can_send_message', array( $this, 'block_reply_if_needed' ), 20, 3 );\n                 add_filter( 'better_messages_can_send_message', array( $this, 'check_ai_bot_balance' ), 21, 3 );\n                 add_action( 'better_messages_before_new_thread',  array( $this, 'restrict_new_thread_if_needed'), 10, 2 );\n@@ -191,23 +192,191 @@\n \n             $recipients = Better_Messages()->functions->get_recipients( $thread_id );\n \n-            if( count( $recipients ) === 2 ) {\n-                foreach ($recipients as $user) {\n-                    $user_id = $user->user_id;\n-                    if ($user_id \u003C 0) {\n-                        $guest_id = absint($user_id);\n-                        $guest = Better_Messages()->guests->get_guest_user($guest_id);\n+            if( count( $recipients ) !== 2 ) {\n+                return;\n+            }\n+\n+            $bot_id = 0;\n+            $other_user_id = 0;\n+\n+            foreach ( $recipients as $user ) {\n+                $user_id = (int) $user->user_id;\n+                $candidate_bot_id = $user_id \u003C 0 ? $this->get_bot_id_from_user( $user_id ) : false;\n+\n+                if ( $candidate_bot_id && $this->bot_exists( $candidate_bot_id ) ) {\n+                    Better_Messages()->functions->update_thread_meta( $thread_id, 'ai_bot_thread', $candidate_bot_id );\n+                    $bot_id = $candidate_bot_id;\n+                } else {\n+                    $other_user_id = $user_id;\n+                }\n+            }\n+\n+            if ( $bot_id > 0 && $other_user_id !== 0 ) {\n+                $this->maybe_send_welcome_message( $thread_id, $bot_id, $other_user_id, $message_id );\n+            }\n+        }\n+... (truncated)","1. Attacker constructs a POST request to '\u002Fwp-json\u002Fbetter-messages\u002Fv1\u002Fcloud-ai\u002Fcallback'.\n2. The request is unauthenticated as the 'permission_callback' for this route returns true.\n3. The attacker provides a target 'message_id' belonging to a private conversation they do not have access to.\n4. The attacker sets the 'key' parameter to an arbitrary string (e.g., 'random_key').\n5. The attacker sets the 'action' parameter to 'translate' and provides a 'result' object containing malicious or misleading text.\n6. Because the server does not verify the 'key' against the legitimate Cloud AI secret, it executes handle_translate_callback(), which uses update_message_meta() to overwrite the message's translation data in the database with the attacker's payload.","gemini-3-flash-preview","2026-06-04 18:06:19","2026-06-04 18:07:18",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.14.16","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbp-better-messages\u002Ftags\u002F2.14.16","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbp-better-messages.2.14.16.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbp-better-messages\u002Ftags\u002F2.15.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbp-better-messages.2.15.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbp-better-messages\u002Ftags"]