{"id":"CVE-2026-16585","aliases":["EUVD-2026-49697","GHSA-6fr4-j24c-qcq7"],"status":"published","title":"Better Messages \u003c= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter","description":"The Better Messages – Chat Rooms, Group Chat, Private Messages \u0026 AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01153,"percentile":0.67416,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-07-28T05:39:44Z","modified":"2026-07-28T16:17:32Z","products":[{"vendor":"wordplus","product":"better messages – chat rooms, group chat, private messages \u0026 ai chat bots"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9274957-7584-4df6-bb2a-d745510f5033?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.19/addons/stickers/rest.php#L285"},{"url":"https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.19/addons/stickers/rest.php#L287"},{"url":"https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.19/addons/stickers/pack-manager.php#L764"},{"url":"https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/2.15.19/addons/stickers/rest.php#L153"},{"url":"https://plugins.trac.wordpress.org/changeset/3623636/bp-better-messages/trunk/addons/stickers/rest.php?old=3527109\u0026old_path=bp-better-messages%2Ftrunk%2Faddons%2Fstickers%2Frest.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16585"},{"url":"https://github.com/advisories/GHSA-6fr4-j24c-qcq7"}],"sources":{"cve":[{"id":"CVE-2026-16585","title":"Better Messages \u003c= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter","description":"The Better Messages – Chat Rooms, Group Chat, Private Messages \u0026 AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.","status":"published","published":"2026-07-28T05:39:44.828Z","modified":"2026-07-28T16:05:04.482Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:11.24076Z"}],"euvd":[{"id":"EUVD-2026-49697","description":"The Better Messages – Chat Rooms, Group Chat, Private Messages \u0026 AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.","status":"published","published":"2026-07-28T05:39:44Z","modified":"2026-07-28T16:05:04Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:30.949894Z"}],"ghsa":[{"id":"GHSA-6fr4-j24c-qcq7","title":"The Better Messages – Chat Rooms, Group Chat, Private Messages \u0026 AI Chat Bots plugin for...","description":"The Better Messages – Chat Rooms, Group Chat, Private Messages \u0026 AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.","status":"published","published":"2026-07-28T09:31:28Z","modified":"2026-07-28T09:31:35Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:09:51.995252Z"}],"nvd":[{"id":"CVE-2026-16585","description":"The Better Messages – Chat Rooms, Group Chat, Private Messages \u0026 AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.","status":"published","published":"2026-07-28T07:16:41.993Z","modified":"2026-07-28T16:17:32.097Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:33.249634Z"}]}}