Furthermore, a privilege escalation vector exists within the Migrator::preserveCampaignRoleAccess() function. When updating from versions prior to 3.1.10, the plugin automatically assigns edit_fireboxes and publish_fireboxes capabilities to the Author role. This effectively lowers the barrier to entry for exploitation, allowing any authenticated user with Author-level privileges to achieve server-side code execution.

Impact

Successful exploitation allows authenticated attackers with Author-level access to execute arbitrary PHP code on the underlying web server. This can lead to full site compromise, unauthorized database modification, or the installation of persistent web shells. The vulnerability affects all users running FireBox version 3.1.10 or earlier.

Recommendation

Prioritized actions for security and IT teams:

• Update the FireBox plugin to the latest version immediately to resolve the vulnerable regex blacklist and sanitize inputs in the firebox_meta endpoint.
• Audit existing user accounts with Author roles to identify and remediate accounts that may have gained unnecessary permissions following the migration to version 3.1.10.
• Monitor REST API traffic for POST requests targeting the 'firebox_meta' endpoint containing suspicious function calls or serialized PHP objects.
• Implement strict web application firewall (WAF) rules to inspect incoming requests for function names like 'file_put_contents' or 'wp_insert_user' within JSON bodies destined for the WordPress REST API.