CVE-2026-8787

Summary

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the firebase_auth() function authenticating the request as the WordPress user whose email is supplied in the user_email POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the acb_firebase_auth AJAX action, resulting in full account takeover.

Affected Software

VendorProductVersion RangeStatus
devsabbirahmedFirebase Support & Chat Management<= 3.1.1affected

Weaknesses

  • CWE-269: CWE-269 Improper Privilege Management

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References