Better Messages WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in the Better Messages WordPress plugin, specifically in the Live Chat feature for BuddyPress, PeepSo, Ultimate Member, and BuddyBoss. This vulnerability affects all versions through 2.6.9. The issue arises from an unprotected directory, 'bp-better-messages', which allows unauthenticated attackers to access sensitive data, including file attachments from chat messages, stored in the '/wp-content/uploads/bp-better-messages' directory.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, such as private file attachments included in chat messages.

Remediation

Users can update to version 2.7.0 or a newer patched version to address this vulnerability.