CVE-2026-76801

The FireBox WordPress plugin (popup builder, exit-intent popups, email opt-in, and cart abandonment) is vulnerable to remote code execution through the value function in all versions up to and including 3.1.10. The Executer::allowedToRun() regex blacklist that gates which PHP functions may run is trivially bypassable — it fails to block core functions such as wp_insert_user, update_option, and file_put_contents — and PHP condition rule values saved through the firebox_meta REST endpoint are not sanitized. An authenticated attacker with author-level privileges or higher can therefore store and trigger crafted condition values that execute arbitrary code on the web server. On sites that were upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically granted the edit_fireboxes and publish_fireboxes capabilities to the Author role, widening the pool of accounts able to exploit the flaw. No public proof-of-concept is known and the vulnerability is not listed in CISA KEV, so exploitation status is currently none known.

What to do: Update FireBox to a release newer than 3.1.10 as soon as a patched version is available. On sites upgraded from pre-3.1.10 versions, review the Author role (e.g., with a capabilities manager) and consider removing the automatically granted edit_fireboxes and publish_fireboxes capabilities until all author-level users are trusted, and audit the firebox_meta REST endpoint data for suspicious PHP condition values.