Executive brief
FireBox is a popular WordPress plugin that creates popups and manages cart abandonment campaigns for WooCommerce stores. A vulnerability in versions up to 3.1.10 allows authenticated users with author-level permissions to execute arbitrary code on the server by exploiting a flawed blacklist mechanism and unsanitized input. This gives attackers direct control over the website and underlying server, enabling data theft, malware installation, and complete site compromise.
Technical details
This is a remote code execution vulnerability in the FireBox plugin caused by a bypassable regex blacklist in the Executer::allowedToRun() function combined with inadequate input sanitization. The vulnerability exists in the firebox_meta REST endpoint, which accepts PHP condition rule values without sanitization and fails to properly block dangerous WordPress functions like wp_insert_user, update_option, and file_put_contents. Authenticated attackers with author-level access (or higher) can craft malicious payloads to execute arbitrary PHP code. Notably, sites upgraded from versions prior to 3.1.10 are at higher risk because the Migrator::preserveCampaignRoleAccess() function automatically grants the edit_fireboxes and publish_fireboxes capabilities to the Author role, effectively lowering the privilege requirement. The vulnerability affects all versions up to and including 3.1.10; patches should be applied immediately.
Affected products
- FireBox WooCommerce Popup Builder up to and including 3.1.10
Timeline
- 2026-09-09: disclosed