CVE-2026-76801 Overview
CVE-2026-76801 is a Remote Code Execution (RCE) vulnerability in the FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress. The flaw affects all versions up to and including 3.1.10. Authenticated attackers with Author-level access can execute arbitrary PHP code on the server by abusing the plugin's value function and its PHP condition rules. The vulnerability stems from a bypassable regex blacklist in Executer::allowedToRun() combined with missing sanitization on values stored through the firebox_meta REST endpoint. Sites upgraded from earlier versions are especially exposed because the Migrator::preserveCampaignRoleAccess() function automatically grants edit_fireboxes and publish_fireboxes capabilities to the Author role.
Critical Impact
Authenticated Author-level users can execute arbitrary PHP, invoke wp_insert_user to create administrators, modify options, or write files, resulting in full WordPress site compromise.
Affected Products
- FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress
- All versions up to and including 3.1.10
- Sites upgraded from pre-3.1.10 versions where the Author role received elevated FireBox capabilities
Discovery Timeline
- 2026-09-09 - CVE-2026-76801 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-76801
Vulnerability Analysis
The vulnerability is classified under [CWE-269: Improper Privilege Management]. FireBox exposes a PHP condition rule type that evaluates user-controlled values through its internal Executer component. Before dispatching code, Executer::allowedToRun() applies a regex blacklist intended to block dangerous PHP functions. The blacklist is incomplete and can be trivially bypassed. WordPress core functions such as wp_insert_user, update_option, and file_put_contents are not blocked, so attackers can invoke them directly to escalate privileges, modify site configuration, or drop web shells.
Root Cause
Two weaknesses combine to create the RCE path. First, the firebox_meta REST endpoint in Meta.php stores PHP condition rule values without sanitizing or validating them. Second, Executer::allowedToRun() relies on a denylist regex rather than a strict allowlist. On upgraded sites, Migrator::preserveCampaignRoleAccess() also grants FireBox capabilities to the Author role, lowering the privilege bar required to reach the vulnerable code path.
Attack Vector
An authenticated attacker with Author-level or higher access authenticates to WordPress and sends a crafted request to the firebox_meta REST endpoint. The request stores malicious PHP as the value of a PHP condition rule. When the condition is later evaluated, the Executer component processes the payload, the incomplete blacklist fails to block WordPress core functions, and the injected code runs in the WordPress process context. Refer to the Wordfence Vulnerability Report and the WordPress Firebox Executer Code for the vulnerable logic.
Detection Methods for CVE-2026-76801
Indicators of Compromise
- Unexpected WordPress administrator accounts created after a plugin upgrade, consistent with wp_insert_user abuse.
- Modified WordPress options containing PHP payloads or suspicious values written via update_option.
- New or modified PHP files in wp-content/uploads/ or plugin directories consistent with file_put_contents writes.
- POST requests to the firebox_meta REST endpoint originating from Author-level accounts with encoded PHP payloads.
Detection Strategies
- Review WordPress audit logs for firebox_meta REST calls that include function names such as wp_insert_user, update_option, or file_put_contents.
- Enumerate accounts holding the edit_fireboxes and publish_fireboxes capabilities and verify they are intentionally granted.
- Baseline installed FireBox plugin versions and alert on any version equal to or older than 3.1.10.
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized analytics platform and alert on anomalous REST API traffic from low-privilege users.
- Monitor filesystem changes across the WordPress webroot and plugin directories.
- Track privilege changes and new administrator creation events in WordPress user metadata.
How to Mitigate CVE-2026-76801
Immediate Actions Required
- Update the FireBox plugin to a version newer than 3.1.10 as soon as a fixed release is available from the vendor.
- Audit Author-role accounts and revoke edit_fireboxes and publish_fireboxes capabilities that were granted by the migrator on upgraded sites.
- Rotate credentials for any account with Author-level or higher access and review WordPress administrator accounts for unauthorized additions.
- Inspect the webroot for unfamiliar PHP files and remove any confirmed web shells.
Patch Information
Refer to the WordPress Firebox Changeset for the vendor code changes and to the Wordfence Vulnerability Report for remediation guidance. Administrators should apply the vendor-supplied fixed release, verify the plugin version after upgrade, and validate that Author-role capabilities do not include FireBox editing rights.
Workarounds
- Deactivate the FireBox plugin until a patched version is applied.
- Remove edit_fireboxes and publish_fireboxes capabilities from the Author role using a role management plugin or a custom remove_cap call.
- Restrict access to the WordPress REST API for the firebox_meta endpoint at the web server or WAF layer.
- Limit Author-level account creation and require multi-factor authentication for all WordPress editorial roles.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.