Remote Code Execution in FireBox WooCommerce Plugin

The FireBox plugin for WordPress (all versions up to and including 3.1.10) contains a critical Remote Code Execution (RCE) vulnerability. The flaw exists in the Executer::allowedToRun() function, which relies on a regex blacklist that fails to restrict sensitive WordPress core functions such as wp_insert_user, update_option, and file_put_contents. Because the plugin does not perform adequate input sanitization on PHP condition rule values passed through the firebox_meta REST endpoint, an attacker can supply malicious payloads.

Furthermore, a privilege escalation vector exists within the Migrator::preserveCampaignRoleAccess() function. When updating from versions prior to 3.1.10, the plugin automatically assigns edit_fireboxes and publish_fireboxes capabilities to the Author role. This effectively lowers the barrier to entry for exploitation, allowing any authenticated user with Author-level privileges to achieve server-side code execution.

Impact

Successful exploitation allows authenticated attackers with Author-level access to execute arbitrary PHP code on the underlying web server. This can lead to full site compromise, unauthorized database modification, or the installation of persistent web shells. The vulnerability affects all users running FireBox version 3.1.10 or earlier.

Recommendation

Prioritized actions for security and IT teams:

• Update the FireBox plugin to the latest version immediately to resolve the vulnerable regex blacklist and sanitize inputs in the firebox_meta endpoint.
• Audit existing user accounts with Author roles to identify and remediate accounts that may have gained unnecessary permissions following the migration to version 3.1.10.
• Monitor REST API traffic for POST requests targeting the 'firebox_meta' endpoint containing suspicious function calls or serialized PHP objects.
• Implement strict web application firewall (WAF) rules to inspect incoming requests for function names like 'file_put_contents' or 'wp_insert_user' within JSON bodies destined for the WordPress REST API.