FireBox CVE-2026-104724

Requires an authenticated WordPress account with the edit_fireboxes capability reaching the FireBox 'Form Display Condition' feature. On fresh installations of version 3.1.10 and later, this effectively means administrator-level access; on sites UPGRADED from a version prior to 3.1.10, the preserveCampaignRoleAccess() migration grants edit_fireboxes to any role that previously held edit_posts, lowering the requirement to Author-level - this upgrade history is the key enabling condition. Limiting factors: attacker must already be authenticated (PR:L minimum, PR:H on fresh installs), the plugin must be installed and ≤3.1.13, and exploitation complexity is high (AC:H). Impact is confined to confidentiality (data extraction); no integrity or availability impact.

This is a genuine but moderate-priority issue rather than an urgent fire. The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning network-reachable but with high attack complexity, requiring existing authenticated privileges, and impacting only confidentiality. The high confidentiality impact (C:H) reflects that SQL injection can extract sensitive database contents (password hashes, PII, secret keys), which is the primary concern. However, several factors sharply limit real-world risk: no EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit code is identified - exploitation status is therefore 'no public exploit identified at time of analysis.' The most important nuance is the privilege requirement: on fresh installations of 3.1.10 and later the attacker needs administrator-level access (a very high bar, since an admin can already read the database), which would arguably warrant PR:H and makes the practical impact low. The PR:L rating only holds on sites upgraded from a version prior to 3.1.10, where the preserveCampaignRoleAccess() migration erroneously grants the edit_fireboxes capability to any role that previously had edit_posts - lowering the bar to Author-level. The AC:H rating further reflects that exploitation depends on this specific migration state. Net assessment: real but conditional priority - patch promptly on upgraded multi-author sites, lower urgency on fresh single-admin installs.

An attacker who holds an Author-level account on a WordPress site that was upgraded from a FireBox version prior to 3.1.10 (where the edit_fireboxes capability was mistakenly granted to edit_posts roles) crafts a malicious value in the FireBox Form Display Condition. Because the user-supplied parameter is insufficiently escaped and the SQL query is not properly prepared, the attacker appends additional SQL to extract password hashes, user data, or API keys from the database. No public exploit code has been identified, and on fresh 3.1.10+ installs the same attack requires administrator access.