CVE-2026-8787

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the `acb_firebase_auth` AJAX action, resulting in full account takeover.

• CWE-269

• https://plugins.trac.wordpress.org/browser/admin-chat-box/tags/3.1.1/inc/ACB_AjaxHandler.php#L237
• https://plugins.trac.wordpress.org/browser/admin-chat-box/tags/3.1.1/inc/ACB_AjaxHandler.php#L338
• https://plugins.trac.wordpress.org/browser/admin-chat-box/trunk/inc/ACB_AjaxHandler.php#L237
• https://plugins.trac.wordpress.org/browser/admin-chat-box/trunk/inc/ACB_AjaxHandler.php#L338
• https://www.wordfence.com/threat-intel/vulnerabilities/id/90783d75-a255-4133-ac7b-32e0a70c8c69?source=cve

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-87853A flaw was found in SSSD's IdP authentication provider. The …7.5
• CVE-2026-87854The Subscriptions for WooCommerce WordPress plugin before 2.…5.3
• CVE-2026-87858Temporal Server decided whether a Workflow completion callba…7.2
• CVE-2026-87859morgan is an HTTP request logger middleware for Node.js. In …5.3
• CVE-2026-8786A vulnerability has been found in Tencent WeKnora up to 0.3.…6.3
• CVE-2026-87860The Subscriptions for WooCommerce WordPress plugin before 2.…4.3
• CVE-2026-87870The Ninja Forms - Scheduled Exports plugin for WordPress is …6.4
• CVE-2026-87872A flaw was found in the OCAPI modules (ocapi_command, ocapi_…6.8
• CVE-2026-87874A flaw was found in the memcached cache plugin of the commun…8.1
• CVE-2026-87875The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c la…4.3
• CVE-2026-87876Two case-insensitive comparisons on request-derived username…3
• CVE-2026-87877zstd-jni versions before 1.5.7-14 fail to validate closed st…7.7