CVE-2024-13611: Better Messages Information Disclosure Flaw

CVE-2024-13611 Overview

CVE-2024-13611 affects the Better Messages – Live Chat plugin for WordPress, used to integrate chat functionality with BuddyPress, PeepSo, Ultimate Member, and BuddyBoss. The plugin stores chat file attachments in a publicly accessible directory under /wp-content/uploads/bp-better-messages. Unauthenticated attackers can enumerate and retrieve these files directly over the network, exposing private message attachments to anyone on the internet. The flaw affects all plugin versions up to and including 2.6.9 and is categorized under CWE-200 Information Exposure.

Critical Impact
Unauthenticated remote attackers can retrieve private chat attachments from affected WordPress sites without any user interaction or authentication.

Affected Products

Wordplus Better Messages plugin for WordPress versions up to and including 2.6.9
WordPress sites integrating Better Messages with BuddyPress, PeepSo, Ultimate Member, or BuddyBoss
Any deployment exposing /wp-content/uploads/bp-better-messages to anonymous HTTP clients

Discovery Timeline

2025-03-01 - CVE-2024-13611 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13611

Vulnerability Analysis

The Better Messages plugin allows users to attach files to private chat messages. The plugin writes uploaded attachments to /wp-content/uploads/bp-better-messages without applying access control to the storage location. Because WordPress serves the wp-content/uploads directory directly through the web server, files placed there are reachable by any HTTP client that knows or guesses the URL. The plugin does not gate access through PHP, does not randomize filenames with sufficient entropy in vulnerable versions, and does not generate .htaccess restrictions for the directory. Attackers can therefore download files intended only for chat participants.

Root Cause

The root cause is insecure storage of user-generated content combined with missing authorization checks. The attachment handler in addons/files.php saves files inside the public uploads tree rather than routing downloads through an authenticated PHP endpoint that verifies the requester is a participant in the conversation. See the WordPress Plugin File Overview for the relevant component and WordPress Changeset #3228957 for the fix.

Attack Vector

An unauthenticated attacker sends HTTP GET requests to predictable paths under /wp-content/uploads/bp-better-messages/. If directory listing is enabled, the attacker enumerates files directly. If listing is disabled, the attacker brute-forces filenames or harvests references leaked through other channels. Successful requests return raw attachment content including documents, images, or other files exchanged in private conversations. No credentials, tokens, or user interaction are required.

The vulnerability is described in prose because no public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report for additional context.

Detection Methods for CVE-2024-13611

Indicators of Compromise

Unauthenticated HTTP GET requests targeting paths under /wp-content/uploads/bp-better-messages/ from external IPs
Web server logs showing directory enumeration attempts or sequential filename probing against the attachment directory
Requests for attachment files originating from IP addresses not associated with logged-in chat participants

Detection Strategies

Audit web server access logs for any external requests reaching /wp-content/uploads/bp-better-messages and correlate against authenticated session activity
Identify installed Better Messages plugin versions across WordPress estates and flag any instance at 2.6.9 or earlier
Monitor for HTTP 200 responses serving non-image MIME types from the uploads directory to unauthenticated clients

Monitoring Recommendations

Forward WordPress access logs to a centralized log platform and alert on bursts of requests against the plugin's upload path
Track plugin inventory and version drift across multisite or hosted WordPress environments
Review CDN and reverse-proxy logs for cache hits on attachment URLs served without referer or session context

How to Mitigate CVE-2024-13611

Immediate Actions Required

Update the Better Messages plugin to a version newer than 2.6.9 that includes the fix from WordPress Changeset #3228957
Block direct web access to /wp-content/uploads/bp-better-messages/ at the web server or WAF until the patch is applied
Rotate or remove sensitive attachments already stored in the exposed directory and notify affected users where appropriate

Patch Information

The vendor addressed the issue in the plugin update referenced by WordPress Changeset #3228957. Administrators should update through the WordPress plugin dashboard or by deploying the fixed package from the official repository. Verify that the addons/files.php handler enforces participant checks before serving attachments.

Workarounds

Add a web server rule denying anonymous access to /wp-content/uploads/bp-better-messages/ and route requests through an authenticated handler
Disable directory listing on the web server to prevent file enumeration
Temporarily deactivate the Better Messages plugin if attachments contain regulated or sensitive data and a patch cannot be deployed immediately

bash

# Apache: block direct access to the vulnerable upload directory
# Place in .htaccess at the WordPress root or inside the bp-better-messages folder
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-content/uploads/bp-better-messages/.*$ - [F,L]
</IfModule>

# Nginx equivalent
location ^~ /wp-content/uploads/bp-better-messages/ {
    deny all;
    return 403;
}