Junglewise Threat Intelligence

CVE-2026-8787: WordPress Firebase Support & Chat Management privilege escalation

CVE-2026-8787 · Severity: high · CVSS 8.8 · Published 2026-05-27

Executive brief

The Firebase Support & Chat Management plugin for WordPress, which adds chat functionality to websites, contains a security flaw that allows low-level users to take over administrator accounts. By simply providing an administrator's email address, an attacker can bypass authentication and gain full control over the website. This could lead to total site compromise, data theft, or the installation of malicious software.

Technical details

The vulnerability exists in the `firebase_auth()` function within the Firebase Support & Chat Management plugin for WordPress. The root cause is a lack of proper authentication verification; the function authenticates requests based solely on the `user_email` POST parameter without validating Firebase ID token signatures, issuers, or audiences. An attacker with at least Subscriber-level permissions can exploit the `acb_firebase_auth` AJAX action by submitting a target user's email address. This results in an authentication bypass and full account takeover of the specified user, including those with Administrator privileges.

Affected products

  • Firebase Support & Chat Management Team Firebase Support & Chat Management Up to, and including, 3.1.1

Timeline

  • 2026-05-27: disclosed
  • 2026-05-27: advisory

References