Now officially on WordPress.org

CVE Database / CVE-2020-36838

CVE · High

CVE-2020-36838 — Facebook Chat Plugin – Live Chat Plugin for WordPress [facebook-messenger-customer-chat] < 1.6

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2020-36838 Facebook Chat Plugin – Live Chat Plugin for WordPress [facebook-messenger-customer-chat] < 1.6 Improper Access Control High 7.4 < 1.6 1.6 2020-08-04 —

CVE-2020-36838

The Facebook Chat Plugin for WordPress contains an authorization bypass flaw in versions 1.5 and earlier, stemming from inadequate permission validation in the wp_ajax_update_options function. Attackers with low-level authentication credentials can exploit this vulnerability to link their personal Facebook Messenger account to a website and initiate conversations with site visitors. The vulnerability was patched in version 1.6.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings