WordPress security changelog
HIGH CVE-2026-76801 Deferred

FireBox permits author-level code execution through PHP condition rules

FireBox through 3.1.10 stores unsanitized PHP condition-rule values through the firebox_meta REST endpoint. When the value function evaluates them, the regex blacklist in Executer::allowedToRun() fails to prevent dangerous function calls, allowing server-side code execution. On sites upgraded from a version before 3.1.10, Migrator::preserveCampaignRoleAccess() grants Authors edit_fireboxes and publish_fireboxes, making those Author accounts able to reach the vulnerable functionality.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment
Plugin slug
firebox
Affected
<= 3.1.10
Safe version
3.1.11
Published
Sep 09, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Sep 09, 2026 and is one of 4 known issues for this plugin.

What to do

Update, patch or deactivate.

Update FireBox to 3.1.11 or later. The official changelog identifies the matching fix. The checked current release is 3.1.13.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core functions such as wp_insert_user, update_option, and file_put_contents, combined with no sanitization of PHP condition rule values stored via the firebox_meta REST endpoint. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. On sites upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically grants the edit_fireboxes and publish_fireboxes capabilities to the Author role, lowering the effective entry point to Author-level access.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources