CVE-2020-36838
High
Description
The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites.
SeverityHigh
CVSS7.4
Exploit probability—
ProductFacebook Chat Plugin – Live Chat Plugin for WordPress
PublishedOct 16, 2024
First seenOct 16, 2024
Weakness typeCWE-284Improper access control
How to fix
Update
- facebook Facebook Chat Plugin – Live Chat Plugin for WordPress1.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| facebook Facebook Chat Plugin – Live Chat Plugin for WordPress | v < 1.6 | 1.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.