High severity7.5NVD Advisory· Published Mar 1, 2025· Updated Jun 17, 2026

CVE-2024-13611

Description

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/bp-better-messages directory which can contain file attachments included in chat messages.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Better Messagesllm-fuzzy2 versions
<=2.6.9+ 1 more
- (no CPE)range: <=2.6.9
- (no CPE)
wordplus/Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messagesv5
Range: 0

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/997918b9-2ccd-413e-9df2-d24bc3820ba1nvdThird Party Advisory
plugins.trac.wordpress.org/browser/bp-better-messages/trunk/addons/files.phpnvdProduct
plugins.trac.wordpress.org/changeset/3228957/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000