CVE-2026-8787Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the `acb_firebase_auth` AJAX action, resulting in full account takeover.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-06-01); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Full discourse2 posts

Joey Romaine 🇺🇸 |=★=|@Tank23x0111d
Disclosure
CVE-2026-8787: high severity (CVSS 8.8). Firebase Support & Chat Management plugin for WordPress has a privilege escalation issue worth scoping now. The calm team is usually the team that practiced the boring parts.
Post summary
The post only notes the high‑severity privilege‑escalation vulnerability (CVE‑2026‑8787) in the Firebase Support & Chat Management WordPress plugin, without providing exploitation or patch details.
1000050
335 followersView on X
DFIR Lab@DFIR_Lab137d
Disclosure
🚨 HIGH: CVE-2026-8787 (CVSS 8.8) - Firebase Support & Chat plugin for WordPress allows privilege escalation to Admin. Authenticated attackers can hijack any account via email parameter. Affects all versions ≤3.1.1. #CVE #WordPress #PatchNow https://t.co/MvgljMmkr3
Post summary
The tweet discloses a high‑severity privilege‑escalation vulnerability (CVE‑2026‑8787) in Firebase Support & Chat plugin for WordPress affecting all versions ≤3.1.1, without mentioning active exploitation, a patch, or a PoC.
0000040
35 followersView on X

Explore more

Back to dashboard