CVE-2026-76801 is a high-severity remote code execution vulnerability in the FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment WordPress plugin. The vulnerability arises from an ineffective regex blacklist in Executer::allowedToRun() that fails to block critical WordPress core functions such as wp_insert_user, update_option, and file_put_contents. Combined with the absence of sanitization on PHP condition rule values stored via the firebox_meta REST endpoint, this allows authenticated attackers with author-level privileges or higher to execute arbitrary PHP code on the server. Furthermore, the Migrator::preserveCampaignRoleAccess() function in upgrades from versions prior to 3.1.10 automatically grants edit_fireboxes and publish_fireboxes capabilities to the Author role, effectively reducing the required privilege level for exploitation to author-level access.

Successful exploitation allows an authenticated user with author-level or higher privileges to execute arbitrary PHP code on the server hosting the WordPress site. This can lead to full compromise of the affected system, including unauthorized data access, modification, or destruction, and potentially complete control over the web server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict author-level access to trusted users only and monitor for suspicious activity related to the firebox_meta REST endpoint. Review and adjust user capabilities, especially if the site was upgraded from a version prior to 3.1.10, to ensure that the Author role does not have elevated permissions such as edit_fireboxes and publish_fireboxes.