14 matches found
WordPress Firebase Authentication plugin < 1.7.1 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Abdullah Kareem in WordPress Plugin Firebase Authentication versions 1.7.1...
CVE-2026-76793
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...
EUVD-2026-64224
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...
CVE-2026-76793 Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...
CVE-2026-76793 Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...
CVE-2026-76793
The Firebase Authentication WordPress plugin versions before 1.7.1 is vulnerable to an unauthenticated account takeover . The root cause is that the plugin fails to verify the email address within an authentication token before matching it to a WordPress account and issuing a session. This allows...
PT-2026-79515
Name of the Vulnerable Software and Affected Versions Firebase Authentication WordPress plugin versions prior to 1.7.1 Description An issue exists where the plugin fails to verify the email address within an authentication token before matching it to a WordPress account and issuing a session. Thi...
CVE-2026-76793: Improper Authentication
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...
CVE-2026-16030 MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...
CVE-2026-8787
The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the firebaseauth function authenticating the request as the WordPress user whose email is supplied in the useremail POST parameter without...
WordPress plugin Firebase Support and Chat Management has unknown vulnerabilities
This platform has the capability to set up personal blog websites on a server based on PHP and MySQL. A WordPress plugin is an application plugin. There is a security vulnerability in the WordPress plugin “Firebase Support and Chat Management.” This vulnerability stems from the fact that the...
CVE-2026-8787
The CVE applies to the WordPress plugin Firebase Support & Chat Management (up to version 3.1.1 ). The root cause is in the firebase_auth() function, which authenticates using the target WordPress user’s email supplied in the user_email POST parameter without verifying ownership or issuing a vali...
CVE-2026-8787
The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the firebaseauth function authenticating the request as the WordPress user whose email is supplied in the useremail POST parameter without...
EUVD-2026-32079
The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the firebaseauth function authenticating the request as the WordPress user whose email is supplied in the useremail POST parameter without...