CVE-2026-8787

The record

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the `acb_firebase_auth` AJAX action, resulting in full account takeover.

Affected packages

Related vulnerabilities

• CVE-2026-63339 IXP Manager is a full-stack web application for managing Internet Exchange Points. CWE-269
• CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. CWE-269
• CVE-2026-61850 Kargo manages and automates the promotion of software artifacts. CWE-269
• CVE-2026-118205 The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for… CWE-269
• CVE-2026-105894 The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine… CWE-269
• CVE-2026-101213 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege… CWE-269
• CVE-2026-59386 A SpaceSupporter could improperly modify an application's start command and… CWE-269
• CVE-2026-113616 The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset… CWE-269