Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter

Summary

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.

Timeline

1. Jul 28, 2026, 5:39 AM UTCCVE published
2. Jul 28, 2026, 4:04 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Jul 28, 2026, 4:05 PM UTCRecord last updated

Affected versions

• wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

  through 2.15.19

References 6