{
 "id": "WPSEC-2026-1267",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1267/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1267/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1267/index.md",
 "title": "Better Messages <= 3.1.2 - Authenticated (Subscriber+) Server-Side Request Forgery via Link Preview",
 "description": "The Better Messages plugin for WordPress is vulnerable to Server-Side Request Forgery via the link preview feature in all versions up to, and including, 3.1.2. This is due to insufficient validation of URLs in messages: the URL check does not block link-local (such as 169.254.169.254), IPv6 and other reserved address ranges, the page fetch uses wp_remote_get(), which follows redirects without checking where they lead, and og:image, twitter:image and thumbnail URLs taken from the fetched page are requested with no validation at all. This makes it possible for authenticated attackers, with subscriber-level access and above who can send messages, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.",
 "plugin": {
  "slug": "bp-better-messages",
  "name": "Better Messages",
  "full_name": "Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots",
  "wordpress_org": "https://wordpress.org/plugins/bp-better-messages/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bp-better-messages/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bp-better-messages"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.3",
 "remediation": "Update to 3.1.3 or later.",
 "fix_released": "2026-10-18T22:27:56+00:00",
 "published": "2026-10-20T10:08:26+00:00",
 "updated": "2026-10-20T09:12:53.063122+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1267/",
  "https://plugins.svn.wordpress.org/bp-better-messages/tags/3.1.3/",
  "https://wordpress.org/plugins/bp-better-messages/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bp-better-messages",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-20"
 }
}