CVE-2026-42736
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
CVE-2026-42736 describes an authorization bypass vulnerability through a user-controlled key in the BP Better Messages plugin. This issue affects versions from n/a through 2.14.16 inclusive.
Risk Assessment
Organizations may be exposed to unauthorized access to plugin features, potentially leading to data leaks or unauthorized user actions.
Recommendation
It is recommended to update the BP Better Messages plugin to the latest version to mitigate this vulnerability and improve access control configuration.
Other vulnerabilities in BP Better Messages
See all- CVE-2026-114179High
The WordPress plugin BP Better Messages up to version 3.1.3 is vulnerable to DOM-based XSS due to improper neutralization of input during web page generation. An attacker could exploit DOM manipulation to execute a malicious script in the victim's browser.
- CVE-2026-84812High
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages versions up to 2.15.27.
- CVE-2026-32547High
BP Better Messages versions up to 2.15.22 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through <= 2.14.16.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS