CVE-2026-42736 HIGH

CVE-2026-42736: WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability

Vendor Wordplus

Product BP Better Messages

Weakness CWE-639 · IDOR

Published May 27, 2026

Last update May 27, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through <= 2.14.16.

Explanation of Vulnerability in Simple Terms

02Summary

BP Better Messages versions up to 2.14.16 contain an authorization flaw that allows unauthenticated attackers to read sensitive data. The vulnerability requires only network access and no user interaction. An attacker can retrieve confidential information without logging in or performing any special actions.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the site without logging in.

Potential impact on your site

04Site Impact

Confidential information may be exposed to anyone on the internet.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

May 27, 2026 CVE published

May 27, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-42736 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html AskarLabs — CWE-639 write-up Authorization Bypass Through User-Controlled Key

Related vulnerabilities

08Related CVE

CVE-2026-8679 AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter CVE-2026-5395 Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter CVE-2026-7648 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter CVE-2026-2554 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion CVE-2026-6206 MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter