CVE-2026-89334 is an authorization bypass vulnerability (CWE-862) in the Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots WordPress plugin. The plugin fails to properly verify user authorization for certain actions, enabling authenticated users with custom-level access or above to access sensitive chat-room data including message transcripts and user metadata. This issue affects all plugin versions up to and including 2.15.33 and is contingent on the 'only_joined_can_read' setting being at its default '0' value.

An attacker with authenticated access at custom-level or higher can bypass authorization controls to read full chat-room message transcripts, thread metadata, and user data. This compromises confidentiality of chat communications and user information. There is no indication of impact to integrity or availability. The vulnerability requires authentication and is limited by the plugin setting 'only_joined_can_read'.

No official patch or fix is currently documented. Users should verify and consider changing the 'only_joined_can_read' setting from its default value '0' to restrict unauthorized reading of chat-room content. Monitor vendor advisories for any forthcoming patches or updates addressing this vulnerability.