CVE-2026-16585: 
WordPress vulnerability analysis and mitigation

CVE-2026-16585 is an arbitrary file deletion vulnerability via path traversal in the Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots WordPress plugin. It affects all versions up to and including 2.15.19, developed by WordPlus. The vulnerability was published on July 28, 2026, and a patch has been released. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The root cause is improper path validation (CWE-22) in the delete_sticker function within addons/stickers/rest.php. The normalize_sticker function applies only esc_url_raw() to sanitize sticker URLs, which does not strip ../ directory traversal sequences. As a result, an attacker can craft a URL that begins with the legitimate WordPress uploads base URL but embeds ../ sequences in the path portion; this payload is stored verbatim in WordPress options and later used by delete_sticker to resolve and delete arbitrary files on the server. The prefix check intended to restrict deletions to the uploads directory is therefore trivially bypassed (GitHub Advisory).

An authenticated attacker with administrator-level access can delete arbitrary files on the web server, including critical WordPress files such as wp-config.php. Deleting wp-config.php forces WordPress into a re-installation state, which an attacker can exploit to gain full control of the site and achieve remote code execution. This results in high confidentiality, integrity, and availability impact across the affected WordPress installation (GitHub Advisory).

1. Gain Administrator Access: Obtain WordPress administrator credentials through phishing, credential stuffing, or another means, as exploitation requires authenticated administrator-level access.
2. Identify the Plugin: Confirm the target WordPress site is running the Better Messages plugin version ≤ 2.15.19 by inspecting plugin metadata or HTTP responses.
3. Craft a Malicious Sticker URL: Construct a URL that begins with the legitimate WordPress uploads base URL (e.g., https://example.com/wp-content/uploads/) but embeds ../ traversal sequences in the path, such as https://example.com/wp-content/uploads/../../wp-config.php.
4. Store the Payload: Submit the crafted URL via the sticker management REST API endpoint (e.g., addons/stickers/rest.php). The normalize_sticker function applies only esc_url_raw(), which does not strip ../ sequences, so the traversal payload is stored verbatim in WordPress options.
5. Trigger File Deletion: Call the delete_sticker REST API endpoint referencing the stored malicious sticker URL. The delete_sticker function resolves the stored path and deletes the targeted file (e.g., wp-config.php) outside the intended uploads directory.
6. Achieve Remote Code Execution: With wp-config.php deleted, WordPress enters a re-installation state. The attacker navigates to the WordPress setup page and reconfigures the site with attacker-controlled database credentials, gaining full administrative control and the ability to execute arbitrary code (GitHub Advisory).

• Logs: WordPress REST API access logs showing authenticated POST/DELETE requests to sticker management endpoints (/wp-json/ paths related to bp-better-messages stickers) with URLs containing ../ sequences.
• File System: Unexpected absence of wp-config.php or other critical WordPress core files; unexpected modification timestamps on WordPress options table entries storing sticker URLs.
• Network: HTTP requests to the WordPress REST API from administrator accounts at unusual times or from unfamiliar IP addresses, particularly targeting sticker-related endpoints.
• Database: WordPress wp_options table entries for Better Messages sticker packs containing path traversal sequences (e.g., ../../) in URL values.

Update the Better Messages plugin to a version above 2.15.19, which includes a fix that properly normalizes file paths before deletion (patch changeset available at the WordPress plugin repository) (GitHub Advisory). As a workaround prior to patching, restrict REST API access to trusted administrator accounts and monitor for anomalous file deletion activity. Implement server-level file integrity monitoring (e.g., on wp-config.php) to detect unauthorized deletions. Ensure the principle of least privilege is applied to WordPress administrator accounts.