CVE-2026-42736

Vulnerability

Insecure Direct Object Reference (IDOR) vulnerability in BP Better Messages allows attackers to bypass authorization controls via user-controlled keys. Affects versions from n/a through 2.14.16. [1]

Exploitation

An authenticated user (any role) can manipulate object references (e.g., message or conversation IDs) to access private messages or conversations belonging to other users without proper permission checks. No additional privileges or user interaction required beyond being logged in. [1]

Impact

Successful exploitation leads to unauthorized read access to private messages, potentially exposing sensitive information. In some scenarios, the attacker may modify or delete messages, compromising confidentiality and integrity. [1]

Mitigation

Update to version 2.15.0 or later, which fixes the issue. If immediate update is not possible, apply a mitigation rule (e.g., via Patchstack) to block attacks until the update is applied. [1]