CVE-2026-89093 | CVSS: 5.3 | 严重级别: MEDIUM
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the `is_ai_bot_user()` function identifying privileged internal AI bot accounts by performing a prefix check for `'ai-chat-bot-'` against a guest record's stored IP address, which is populated verbatim from the client-controlled `X-Real-IP` request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the
参考链接:
• https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.33/inc/c
• https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.33/inc/c
• https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.33/inc/c
📌 数据来源: NVD 官方