The vulnerability identified as CVE-2026-42736 in the BP Better Messages plugin involves an authorization bypass through a user-controlled key. This occurs due to improperly configured access control security levels within the plugin, allowing attackers to circumvent authorization checks. The issue affects all versions up to 2.14.16. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authorization controls and access sensitive information protected by the BP Better Messages plugin. The impact is limited to confidentiality as per the CVSS vector, with no reported effects on integrity or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from wordplus and consider restricting access to the affected plugin where possible. No vendor-provided mitigation or temporary fixes are currently documented.