The Better Messages – Live Chat plugin for WordPress and related platforms contains a sensitive information exposure vulnerability (CWE-200) in all versions up to 2.6.9. The issue arises from insecure storage of file attachments in the /wp-content/uploads/bp-better-messages directory, which can be accessed by unauthenticated attackers. This allows unauthorized actors to extract sensitive data from chat message attachments. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact without integrity or availability impact. No patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.

An unauthenticated attacker can access sensitive file attachments stored by the Better Messages plugin, leading to disclosure of confidential information. This compromises the confidentiality of user communications and any sensitive data contained in chat attachments. There is no indication of impact on integrity or availability. The vulnerability affects all plugin versions up to 2.6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting public access to the /wp-content/uploads/bp-better-messages directory via web server configuration or other access controls to prevent unauthorized file retrieval.