Executive Summary

The Firebase Support & Chat Management plugin for WordPress has a privilege escalation vulnerability in all versions up to and including 3.1.1. This occurs because the plugin's firebase_auth() function authenticates requests based solely on the email address provided in the user_email POST parameter, without verifying that the requester actually owns that email. Specifically, it lacks Firebase ID token signature, issuer, and audience verification.

As a result, an attacker who is already authenticated with at least Subscriber-level access can impersonate any existing user by submitting that user's email address to the acb_firebase_auth AJAX action. This can lead to full account takeover, including Administrator accounts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows attackers with minimal privileges (Subscriber-level or higher) to escalate their access to any user account, including administrators. This means an attacker can gain full control over the WordPress site by taking over high-privilege accounts.

The consequences include unauthorized access to sensitive data, modification or deletion of content, installation of malicious code, and disruption of site operations.

Useful 0 Not Useful 0