What is the CVSS score of CVE-2026-8787?

CVE-2026-8787 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-8787?

The Firebase Support & Chat Management WordPress plugin (versions up to 3.1.1) contains a critical account takeover vulnerability allowing authenticated Subscriber-level users to compromise any…

How to fix or mitigate CVE-2026-8787?

24 hours: Identify all WordPress installations using this plugin and assess business criticality; immediately disable the plugin if alternatives exist. 7 days: Contact the plugin vendor for patch status and timeline; implement restricted access to the acb_firebase_auth AJAX endpoint and strengthen authentication logging. 30 days: Upon vendor patch release, test in staging and deploy to all affected WordPress instances; evaluate long-term replacement with maintained alternatives.

WordPress CVE-2026-8787

EUVD-2026-32079 HIGH

Improper Privilege Management (CWE-269)

2026-05-27 security@wordfence.com

GHSA-g86w-5353-83r2

Privilege Escalation WordPress

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:42 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

HIGH 8.8

DescriptionCVE.org

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the firebase_auth() function authenticating the request as the WordPress user whose email is supplied in the user_email POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user - including an Administrator - by submitting that user's email address to the acb_firebase_auth AJAX action, resulting in full account takeover.

AnalysisAI

Privilege escalation in the Firebase Support & Chat Management WordPress plugin (all versions up to and including 3.1.1) lets any authenticated Subscriber-level user take over any other account, including Administrator. The plugin's acb_firebase_auth AJAX handler logs the request in as whatever WordPress account matches the attacker-supplied user_email parameter, never verifying the accompanying Firebase ID token. No public exploit was identified at time of analysis and the EPSS probability is very low (0.04%, 13th percentile), but the bug is trivially exploitable wherever the plugin is active and a low-privilege account can be obtained.