CVE-2024-13697: CWE-918 Server-Side Request Forgery (SSRF) in wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nice_links'. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Successful exploitation requires the "Enable link previews" to be enabled (default).
AI Analysis
Technical Summary
CVE-2024-13697 is a CWE-918 SSRF vulnerability affecting the Better Messages – Live Chat plugin for WordPress and related platforms. The flaw exists in all versions up to and including 2.7.4 and is triggered via the 'nice_links' feature when 'Enable link previews' is enabled. An unauthenticated attacker can abuse this to cause the server to make arbitrary HTTP requests, potentially interacting with internal network resources. The vulnerability has a CVSS 3.1 base score of 4.8, reflecting low complexity but limited impact on confidentiality and integrity, with no impact on availability.
Potential Impact
Successful exploitation allows unauthenticated attackers to induce the server to send HTTP requests to arbitrary locations, which can lead to unauthorized querying or modification of internal services. The impact on confidentiality and integrity is limited but present, while availability is not affected. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the 'Enable link previews' feature to prevent exploitation. Monitor vendor communications for updates and apply patches promptly once available.
CVE-2024-13697: CWE-918 Server-Side Request Forgery (SSRF) in wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages
Description
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nice_links'. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Successful exploitation requires the "Enable link previews" to be enabled (default).
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-13697 is a CWE-918 SSRF vulnerability affecting the Better Messages – Live Chat plugin for WordPress and related platforms. The flaw exists in all versions up to and including 2.7.4 and is triggered via the 'nice_links' feature when 'Enable link previews' is enabled. An unauthenticated attacker can abuse this to cause the server to make arbitrary HTTP requests, potentially interacting with internal network resources. The vulnerability has a CVSS 3.1 base score of 4.8, reflecting low complexity but limited impact on confidentiality and integrity, with no impact on availability.
Potential Impact
Successful exploitation allows unauthenticated attackers to induce the server to send HTTP requests to arbitrary locations, which can lead to unauthorized querying or modification of internal services. The impact on confidentiality and integrity is limited but present, while availability is not affected. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the 'Enable link previews' feature to prevent exploitation. Monitor vendor communications for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-01-23T23:19:17.165Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6e69b7ef31ef0b5a0270
Added to database: 2/25/2026, 9:49:29 PM
Last enriched: 4/9/2026, 6:46:32 AM
Last updated: 4/12/2026, 3:34:02 PM
Views: 28
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.