Is CVE-2026-93899 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93899 being exploited in the wild.

How severe is CVE-2026-93899?

Medium severity, with a CVSS score of 6.5, published 25 September 2026.

Which products and versions are affected?

ThimPress The Better Messages up to and including 3.0.4.

Is there a fix for CVE-2026-93899?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93899 attacked?

It is attacked over the network.

Am I affected by CVE-2026-93899?

Check whether you run ThimPress The Better Messages at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93899: The Better Messages SQL Injection via group_id parameter

CVE-2026-93899 · Severity: medium · CVSS 6.5 · Published 2026-09-25

The Better Messages WordPress plugin allows authenticated users with basic subscriber access to inject malicious SQL commands through the group chat feature. An attacker could extract sensitive database information, including user credentials and private messages. This vulnerability only affects sites where the BuddyBoss Platform plugin has disabled its Social Groups component.

Vendors: ThimPress.

Quick answers

Is CVE-2026-93899 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93899 being exploited in the wild.
How severe is CVE-2026-93899?: Medium severity, with a CVSS score of 6.5, published 25 September 2026.
Which products and versions are affected?: ThimPress The Better Messages up to and including 3.0.4.
Is there a fix for CVE-2026-93899?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93899 attacked?: It is attacked over the network.
Am I affected by CVE-2026-93899?: Check whether you run ThimPress The Better Messages at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin contains a generic SQL Injection flaw in the group_id Message Meta parameter due to insufficient escaping and lack of prepared statement use. Authenticated attackers with subscriber-level access can append arbitrary SQL queries to extract sensitive data from the database. Exploitation requires BuddyBoss Platform to be installed with Social Groups component disabled, a state that persists due to BuddyBoss not dropping the wp_bp_groups table on deactivation.

Affected products

ThimPress The Better Messages up to and including 3.0.4

Timeline

2026-09-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.