CVE-2026-16585 is a path traversal vulnerability (CWE-22) in the Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots WordPress plugin. The issue arises from insufficient validation of file paths in the delete_sticker function, where the intended restriction to the uploads directory is bypassed by embedding '../' sequences in URLs. The normalize_sticker function only applies esc_url_raw(), which does not remove traversal sequences, allowing attackers with administrator privileges to delete arbitrary files on the server. This can lead to remote code execution if key files such as wp-config.php are deleted. The vulnerability affects all versions up to and including 2.15.19. No patch or official remediation is currently documented.

Authenticated users with administrator-level access can exploit this vulnerability to delete arbitrary files on the server. This can compromise the integrity and availability of the WordPress installation and potentially lead to remote code execution if critical files are deleted. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file deletions. Avoid using the affected plugin versions if possible.