The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Facebook Messenger Customer Chat Plugin | — | Update facebook-messenger-customer-chat plugin to version 1.6, or a newer patched version | May 15, 2025 | Aug 4, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub