CVE-2026-76801
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The FireBox plugin for WordPress (up to version 3.1.10) is vulnerable to Remote Code Execution due to a bypassable regex blacklist in Executer::allowedToRun() and lack of sanitization of PHP condition rule values stored via the firebox_meta REST endpoint. Authenticated attackers with author-level access or above can execute code on the server. On sites upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically grants the Author role the edit_fireboxes and publish_fireboxes capabilities, lowering the effective entry point to Author-level access.
Risk Assessment
An attacker with author-level access can execute arbitrary code on the server, potentially leading to full site compromise, data theft, or further attacks.
Recommendation
It is recommended to immediately update the FireBox plugin to the latest patched version and restrict user privileges to the minimum necessary.
Other vulnerabilities in FireBox
Original NVD description (English source)
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core functions such as wp_insert_user, update_option, and file_put_contents, combined with no sanitization of PHP condition rule values stored via the firebox_meta REST endpoint. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. On sites upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically grants the edit_fireboxes and publish_fireboxes capabilities to the Author role, lowering the effective entry point to Author-level access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS