The Better Messages plugin for WordPress contains a path traversal flaw in the delete_sticker function that allows an authenticated user with Administrator or higher role to delete arbitrary files on the server. By sending a crafted request that includes a relative path beginning with the legitimate uploads base URL but embedding "../" sequences, the plugin stores the traversal payload in a WordPress option. Deleting critical files such as wp‑config.php can lead to remote code execution or other catastrophic failures. This vulnerability is a CWE‑22 type error involving local file path validation.

The flaw affects all releases of Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots up to and including version 2.15.19. No later version of the plugin has been shown to contain the issue, but the vendor has not released a patch or upgrade at the time of this assessment.

With a CVSS score of 7.2 the vulnerability is classified as high severity. The EPSS score is below 1 %, which indicates a low probability of exploitation in the near term, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, because the attack requires only an Administrator privilege – a role typically held by site owners – the potential for serious disruption is significant if an attacker can compromise that account. The flaw is accessed via the plugin’s REST API endpoints that handle stickers; once exploited, an attacker can delete any file on the server that the web process can write to.