CVE-2020-36838: Facebook Chat Plugin – Live Chat Plugin For WordPress

High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days.

The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites.

Affected products

• Facebook Facebook Chat Plugin – Live Chat Plugin For WordPress: before 1.6 (fixed in 1.6)

Published 2024-10-16. Last modified 2026-06-17.