PT-2025-9168 · WordPress · The Better Messages

Tim Coen · Published 2025-03-01 · Updated 2025-05-26 · CVE-2024-13697

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress versions up to, and including, 2.7.4

Description The issue allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. This is possible due to Server-Side Request Forgery via the nice links feature. Successful exploitation requires the "Enable link previews" option to be enabled, which is the default setting.

Recommendations For versions up to, and including, 2.7.4, consider disabling the "Enable link previews" option as a temporary workaround to minimize the risk of exploitation. Additionally, disabling or restricting the use of the nice links feature can help mitigate the issue until a patch is available.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-13697

Affected Products

The Better Messages

References · 9

• https://osv.dev/vulnerability/CVE-2024-13697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13697 · Security Note
• https://twitter.com/cybercronai/status/1896082038010081360 · Twitter Post
• https://t.me/cvedetector/19231 · Telegram Post
• https://t.me/cvenotify/112981 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b67710d7-976b-4a65-bad3-091a97aceb00?source=cve · Note
• https://t.me/cvenotify/123577 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3243180/bp-better-messages · Note
• https://twitter.com/CVEnew/status/1895981987145662876 · Twitter Post