What the vulnerability does
01Description
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nice_links'. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Successful exploitation requires the "Enable link previews" to be enabled (default).
Explanation of Vulnerability in Simple Terms
02Summary
Better Messages versions up to 2.7.4 contain a server-side request forgery vulnerability that allows an attacker to make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability requires high attack complexity but no authentication or user interaction. This could expose internal services or be used to interact with external APIs in unintended ways.
What an attacker can do
03Attacker Capabilities
Make the site send HTTP requests to internal systems or external URLs without authorization.
Potential impact on your site
04Site Impact
Attackers could probe your internal network, access internal services, or interact with external APIs using your site's IP address.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication required, but exploitation requires specific conditions.
Key dates
06Disclosure timeline
March 1, 2025
CVE published
April 8, 2026
Record updated
