CVE-2021-24809

The BP Better Messages plugin version prior to 1.9.9.41 fails to implement cross-site request forgery protections on several AJAX functions, including those for leaving chats, joining chats, leaving threads, muting/unmuting threads, and adding or removing users from threads. An attacker could exploit this weakness to trick authenticated users into performing unintended actions on the plugin without their knowledge or consent.

Based on public CVE data (MITRE/NVD).