CVE-2026-93899 is an SQL Injection vulnerability in the Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots WordPress plugin. It affects all versions up to and including 3.0.4. The flaw arises from improper neutralization of special elements in the 'group_id' message meta parameter, allowing authenticated users with subscriber-level privileges or higher to append malicious SQL queries. This is due to insufficient escaping of user input and lack of prepared statements in the SQL query. Exploitation requires the BuddyBoss Platform plugin to be installed with its Social Groups component disabled, a condition that persists if the component was ever toggled off, leaving the wp_bp_groups table present.

An attacker with subscriber-level access or higher can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. The vulnerability does not affect availability or integrity but compromises confidentiality. The exploitation condition requires a specific plugin configuration (BuddyBoss Platform installed with Social Groups disabled), limiting the attack surface.

No official patch or fix is currently documented for this vulnerability. Users should verify the status of the BuddyBoss Platform Social Groups component and consider enabling it if disabled, as the vulnerability depends on this component being off. Monitor vendor advisories for updates or patches addressing this issue. Until a fix is available, restrict subscriber-level access where possible and review plugin configurations to minimize exposure.