The Firebase Support & Chat Management plugin for WordPress fails to verify ownership of an email supplied to the `firebase_auth()` function. An attacker who is already authenticated with Subscriber‑level or higher privileges can submit any existing user’s email to the `acb_firebase_auth` AJAX action and be logged in as that user. This flaw allows a full account takeover, including access to any Administrator account, without requiring knowledge of the user’s password.

WordPress sites using devsabbirahmed’s Firebase Support & Chat Management plugin up to and including version 3.1.1 are vulnerable. All installations of this plugin that have not been updated beyond that version are at risk.

The CVSS score of 8.8 indicates a high severity weakness. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the risk remains significant due to the potential for immediate account takeover by any authenticated user. The likely attack vector is remote via the plugin’s AJAX endpoint, which is accessible to all logged‑in WordPress users. Exploitation requires only that the attacker possess Subscriber‑level credentials, after which the attacker can send a crafted POST request containing any user’s email to trigger the privilege escalation.