{
 "id": "WPSEC-2026-0731",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0731/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0731/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0731/index.md",
 "title": "Better Messages <= 3.0.13 - Unauthenticated Missing Authorization to User Listing via getUsers REST API Endpoint",
 "description": "The Better Messages plugin for WordPress is vulnerable to unauthorized access of data via the better-messages/v1/getUsers REST API endpoint in all versions up to, and including, 3.0.13, due to the route being registered with a permission callback that always allows access. This makes it possible for unauthenticated attackers to list and search the site's members and their profile data (user ID, display name, avatar, profile URL and last activity), even on sites that do not use the Users widget or restrict it to certain roles.",
 "plugin": {
  "slug": "bp-better-messages",
  "name": "Better Messages",
  "full_name": "Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots",
  "wordpress_org": "https://wordpress.org/plugins/bp-better-messages/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bp-better-messages/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bp-better-messages"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.15.0",
    "from_inclusive": true,
    "to": "3.0.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.15.0 before 3.0.14"
  ]
 },
 "introduced_in": "2.15.0",
 "fixed_in": "3.0.14",
 "remediation": "Update to 3.0.14 or later.",
 "fix_released": "2026-10-08T08:09:32+00:00",
 "published": "2026-10-10T15:41:27+00:00",
 "updated": "2026-10-10T14:53:45.700793+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0731/",
  "https://plugins.svn.wordpress.org/bp-better-messages/tags/3.0.14/",
  "https://wordpress.org/plugins/bp-better-messages/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bp-better-messages",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-10"
 }
}