CVE-2026-16585: Better Messages Path Traversal Vulnerability

CVE-2026-16585 Overview

CVE-2026-16585 is an arbitrary file deletion vulnerability in the Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress. The flaw affects all versions up to and including 2.15.19. It resides in the delete_sticker function, which fails to properly validate file paths before deletion. Authenticated attackers with administrator-level access or above can delete arbitrary files on the server. Deleting sensitive files such as wp-config.php can lead to remote code execution or full site takeover. The vulnerability is classified under [CWE-22] (Path Traversal).

Critical Impact
Authenticated administrators can delete arbitrary server files, potentially triggering remote code execution by removing wp-config.php and forcing WordPress into its setup routine.

Affected Products

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress
All plugin versions up to and including 2.15.19
WordPress sites with administrator-level users installed with the affected plugin

Discovery Timeline

2026-07-28 - CVE-2026-16585 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-16585

Vulnerability Analysis

The vulnerability stems from insufficient file path validation in the Better Messages plugin's sticker management logic. The delete_sticker function attempts to restrict file deletion to the WordPress uploads directory by performing a prefix check against the uploads base URL. However, the guard is only a string-prefix comparison. Attackers can bypass it by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences later in the path. Because the check does not resolve or normalize the path before validation, traversal payloads reach the underlying filesystem deletion call intact.

Root Cause

The normalize_sticker function sanitizes input using only esc_url_raw(). This function is designed to validate URL characters and does not strip ../ traversal sequences. As a result, malicious sticker URLs containing directory traversal are stored verbatim in WordPress options. When the plugin later resolves these stored values into filesystem paths and passes them to the deletion routine, the traversal sequences allow attackers to escape the uploads directory and target any file the web server user can write to.

Attack Vector

An authenticated attacker holding administrator privileges submits a crafted sticker URL through the plugin's REST endpoint (addons/stickers/rest.php). The payload begins with the legitimate uploads base URL to pass the prefix check, then appends ../ sequences to traverse to a target file such as wp-config.php. When the sticker deletion routine executes, the server resolves the traversal and deletes the arbitrary file. Removing wp-config.php causes WordPress to enter its installation flow, which an attacker can hijack to reconnect the site to a database they control and gain code execution.

Code-level references are available in the WordPress BP Sticker Pack Manager source and the WordPress BP Sticker REST endpoint.

Detection Methods for CVE-2026-16585

Indicators of Compromise

Unexpected deletion of wp-config.php, .htaccess, or core WordPress files on hosts running the Better Messages plugin.
WordPress redirecting to /wp-admin/setup-config.php unexpectedly, indicating wp-config.php was removed.
Sticker option entries in the wp_options table containing ../ sequences or URLs that traverse outside /wp-content/uploads/.
REST API requests to /wp-json/ sticker endpoints containing encoded or plain ../ traversal sequences.

Detection Strategies

Inspect WordPress database options related to Better Messages stickers for URL values containing ../ or path segments outside the uploads directory.
Review web server access logs for authenticated POST or DELETE requests to Better Messages sticker REST routes with suspicious URL parameters.
Correlate administrator session activity with filesystem deletion events on the WordPress installation path.

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php, .htaccess, and files under wp-includes/ and wp-admin/.
Alert on any HTTP request to the plugin's REST endpoints originating from administrator accounts outside expected maintenance windows.
Monitor for HTTP 200 responses to sticker deletion requests followed by WordPress errors indicating missing configuration files.

How to Mitigate CVE-2026-16585

Immediate Actions Required

Update the Better Messages plugin to a version newer than 2.15.19 that includes the fix from changeset 3623636.
Audit all administrator accounts and remove any that are unused, shared, or lack multi-factor authentication.
Back up wp-config.php and the WordPress database before applying updates or performing forensic review.
Inspect stored sticker options and remove entries containing ../ or paths outside the uploads directory.

Patch Information

The plugin vendor addressed the vulnerability in a version released after 2.15.19. The fix hardens normalize_sticker and delete_sticker to normalize paths and enforce that resolved filesystem targets remain within the uploads directory. See the Wordfence vulnerability report for advisory details.

Workarounds

Deactivate and remove the Better Messages plugin until the site is updated to a patched version.
Restrict administrator role assignments and enforce multi-factor authentication for all privileged WordPress users.
Apply a web application firewall rule that blocks requests to the plugin's sticker REST endpoints containing ../ sequences.
Set restrictive filesystem permissions so the web server user cannot delete wp-config.php or core files outside wp-content/uploads/.

bash

# Configuration example: harden wp-config.php permissions
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php
# Prevent web-server user from deleting the file by removing write on the parent directory during runtime
chmod 750 /var/www/html