CVE-2026-93899Published
Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-93899 · Microsoft / collected KEV context
cve-program · CVE-2026-93899
- https://www.wordfence.com/threat-intel/vulnerabilities/id/553a9a16-97e0-4443-9d4b-dd901b86141b?source=cve
- https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/addons/buddyboss.php#L635
- https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/inc/rest-api.php#L1073
- https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/inc/functions.php#L3323
- https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/addons/buddyboss.php#L626
- https://plugins.trac.wordpress.org/changeset?old_path=bp-better-messages%2Ftags%2F3.0.3%2Faddons%2Fbuddyboss.php&new_path=bp-better-messages%2Ftags%2F3.0.5%2Faddons%2Fbuddyboss.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.