A critical remote code execution vulnerability in the FireBox plugin for WordPress allows authenticated attackers to gain full control over the affected server.

This flaw involves improper privilege management and insufficient input sanitization within the Executer::allowedToRun() function. Authenticated attackers with author-level access or higher can leverage the firebox_meta REST endpoint to execute arbitrary PHP functions, including those that modify system options or files.

The ability to execute arbitrary code on a web server presents a severe risk to organizational security, potentially leading to total system compromise, data exfiltration, or the deployment of persistent backdoors. Given the CVSS score of 8.8, this vulnerability is categorized as High severity, as it facilitates full unauthorized control over the application environment and connected database assets.

Immediate Action: Update the FireBox plugin to version 3.1.11 or higher immediately to apply the necessary patches.

Proactive Monitoring: Review WordPress audit logs for unusual activity involving the REST API, specifically monitoring for requests targeting the firebox_meta endpoint or unauthorized user account modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious REST API requests or unauthorized attempts to access server-side PHP execution functions.

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available at this time.

Organizations utilizing the FireBox plugin must prioritize updating to version 3.1.11 immediately. Given the potential for remote code execution, failing to patch this vulnerability exposes the host environment to significant risk of compromise. Security teams should audit existing WordPress user roles to ensure that unauthorized accounts do not possess author-level or higher permissions.