CVE-2026-8787 PUBLISHED

Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

Assigner: Wordfence
Reserved: 17.05.2026 Published: 27.05.2026 Updated: 27.05.2026

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the firebase_auth() function authenticating the request as the WordPress user whose email is supplied in the user_email POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the acb_firebase_auth AJAX action, resulting in full account takeover.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor devsabbirahmed
Product Firebase Support & Chat Management
Versions Default: unaffected
  • Version <= 3.1.1 is affected

Credits

  • Farrukh Ziyaev finder

References

Problem Types

  • CWE-269 Improper Privilege Management CWE