Facebook Chat Plugin Vulnerability Allows Hackers to Access Sites

CVE-2020-36838

Summary

The Facebook Chat Plugin for WordPress is susceptible to a significant security flaw that enables low-level authenticated attackers to bypass authorization mechanisms. This vulnerability arises from the absence of a requisite capability check within the wp_ajax_update_options function. As a result, attackers can connect their own Facebook Messenger accounts to any website utilizing the affected plugin, thereby facilitating unauthorized communications with site visitors. This poses a considerable risk to the integrity and trustworthiness of interactions on sites employing this plugin, creating opportunities for social engineering attacks and unauthorized messaging.

References