Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
highThe Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying owner...
- CVSS:
- 8.8
- Affected:
- up to 3.1.1
- Fixed in:
- 3.1.2
- Disclosed:
- May 26, 2026