CVE-2024-13697: Better Messages WordPress Plugin SSRF Flaw

CVE-2024-13697 Overview

CVE-2024-13697 is a Server-Side Request Forgery (SSRF) vulnerability in the Better Messages – Live Chat plugin for WordPress. The plugin supports WordPress, BuddyPress, PeepSo, Ultimate Member, and BuddyBoss integrations. All versions up to and including 2.7.4 are affected. The flaw resides in the nice_links functionality used to render link previews in messages. Unauthenticated attackers can force the web application to issue arbitrary HTTP requests to internal or external endpoints. Successful exploitation requires the plugin option Enable link previews to be turned on, which is the default configuration. The issue is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated remote attackers can pivot through the WordPress host to reach internal services, cloud metadata endpoints, and other network resources otherwise unreachable from the internet.

Affected Products

Wordplus Better Messages – Live Chat plugin for WordPress
All versions up to and including 2.7.4
Deployments where the Enable link previews setting is enabled (default)

Discovery Timeline

2025-03-01 - CVE-2024-13697 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13697

Vulnerability Analysis

The Better Messages plugin exposes a nice_links code path that fetches remote URLs to build link previews for messages. The plugin does not validate or restrict the destination of the outbound request. An unauthenticated attacker can submit a crafted URL that instructs the WordPress server to issue an HTTP request to an attacker-chosen host, including hosts on the internal network.

Because the request originates from the WordPress server, it bypasses network segmentation designed to restrict external access. Attackers can enumerate internal services, query cloud provider metadata services such as 169.254.169.254, or interact with unauthenticated internal admin panels. The response, or the timing behavior of the request, may be reflected back to the attacker depending on how link preview content is rendered.

The Wordfence Vulnerability Report confirms the unauthenticated attack surface and the dependency on the default link-preview configuration.

Root Cause

The root cause is missing validation of the target URL supplied to the nice_links preview handler. The handler accepts arbitrary schemes and hosts, including private IP ranges, loopback addresses, and link-local metadata endpoints. There is no allowlist of external domains and no filter that blocks RFC 1918 or reserved address space.

Attack Vector

Exploitation is remote and requires no authentication or user interaction. An attacker sends a request that triggers the link-preview fetch with a URL targeting an internal resource. The WordPress host then contacts that resource on behalf of the attacker.

The vulnerability manifests in the plugin's nice_links preview fetching routine. See the WordPress Plugin Changeset 3243180 for the specific code modifications that address the flaw.

Detection Methods for CVE-2024-13697

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP worker process to internal IP ranges (RFC 1918) or 169.254.169.254.
Access log entries showing repeated requests to Better Messages endpoints containing URL parameters that reference internal hosts or cloud metadata paths.
Unexpected DNS lookups from the WordPress host for attacker-controlled domains used to confirm SSRF callback.

Detection Strategies

Inspect web server access logs for requests targeting Better Messages message-send or link-preview endpoints with URL-like payloads pointing to private address space.
Correlate PHP-FPM or Apache mod_php outbound network connections with inbound requests to the Better Messages plugin to identify SSRF fetch behavior.
Deploy web application firewall rules that flag requests containing URLs with internal hostnames, IP literals in private ranges, or file://, gopher://, and dict:// schemes.

Monitoring Recommendations

Monitor egress traffic from WordPress hosts and alert on connections to cloud metadata endpoints and internal management interfaces.
Enable verbose logging on the Better Messages plugin and forward logs to a centralized analytics platform for anomaly review.
Track the plugin version installed across WordPress fleets and alert when hosts run versions at or below 2.7.4.

How to Mitigate CVE-2024-13697

Immediate Actions Required

Update the Better Messages plugin to a version later than 2.7.4 on every WordPress site in the environment.
If an immediate upgrade is not possible, disable the Enable link previews option in the Better Messages settings to remove the vulnerable code path.
Restrict outbound network access from WordPress hosts to only the destinations required for operations.

Patch Information

The vendor addressed the SSRF in the WordPress Plugin Changeset 3243180. Administrators should apply the fixed release via the WordPress plugin updater and verify the installed version after upgrade. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Disable the Enable link previews feature within the Better Messages plugin configuration.
Block outbound requests from the WordPress host to RFC 1918 ranges, 127.0.0.0/8, and 169.254.169.254 at the firewall or host level.
Require IMDSv2 on AWS EC2 instances hosting WordPress to mitigate credential theft via metadata SSRF.
Deploy a WAF rule that rejects requests to Better Messages endpoints containing URL parameters resolving to private or reserved IP space.

bash

# Configuration example: block egress to internal ranges from the WordPress host
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT