CVE-2026-8787
Privilege Escalation in Firebase Support & Chat Management WordPress Plugin
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| firebase | firebase_support_and_chat_management_plugin | to 3.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Firebase Support & Chat Management plugin for WordPress has a privilege escalation vulnerability in all versions up to and including 3.1.1. This occurs because the plugin's firebase_auth() function authenticates requests based solely on the email address provided in the user_email POST parameter, without verifying that the requester actually owns that email. Specifically, it lacks Firebase ID token signature, issuer, and audience verification.
As a result, an attacker who is already authenticated with at least Subscriber-level access can impersonate any existing user by submitting that user's email address to the acb_firebase_auth AJAX action. This can lead to full account takeover, including Administrator accounts.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows attackers with minimal privileges (Subscriber-level or higher) to escalate their access to any user account, including administrators. This means an attacker can gain full control over the WordPress site by taking over high-privilege accounts.
The consequences include unauthorized access to sensitive data, modification or deletion of content, installation of malicious code, and disruption of site operations.