What the vulnerability does
01Description
The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the `acb_firebase_auth` AJAX action, resulting in full account takeover.
Explanation of Vulnerability in Simple Terms
02Summary
Firebase Support & Chat Management versions up to 3.1.1 contain a privilege management flaw that allows authenticated users with low-level access to gain unauthorized read and write access to sensitive data and modify site functionality. An attacker with a basic user account can escalate their permissions without additional interaction. This affects confidentiality, integrity, and availability of the affected system.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site content, and disrupt service availability using a low-privilege user account.
Potential impact on your site
04Site Impact
Any registered user can escalate to admin-level access, compromising data security and site integrity.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the site; no special network conditions required.
Key dates
06Disclosure timeline
May 27, 2026
CVE published
May 27, 2026
Record updated
