WordPress BP Better Messages plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation’s set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. The WordPress BP Better Messages plugin has a cross-site request forgery vulnerability in versions prior to 1.9.9.41, which stems from the plugin’s lack of valid CSRF checks for multiple AJAX behaviors in it, which could be exploited by an attacker to allow a logged-in user to perform unwanted actions. required operations.