CVE-2022-40216 MEDIUM

CVE-2022-40216: WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability

Vendor Wordplus
Product Better Messages (WordPress plugin)
Published November 18, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Better Messages WordPress plugin version 1.9.10.69 and earlier contains an authorization flaw that allows authenticated users to modify data they should not have access to. An attacker with a low-privilege account can alter information through the plugin's functionality. The vulnerability requires an active WordPress user account but no additional user interaction.

What an attacker can do

03Attacker Capabilities

Modify data in the plugin that should be restricted to higher-privilege users.

Potential impact on your site

04Site Impact

Unauthorized changes to plugin data by low-privilege users; integrity of messages or settings at risk.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).

Key dates

06Disclosure timeline

November 18, 2022 CVE published
April 28, 2026 Record updated