Executive Summary

This vulnerability in the FileBird WordPress plugin allows authenticated users with author-level access or higher to reset all of the plugin's configuration data without proper authorization. This happens because the plugin's /filebird/v1/fb-wipe-clear-all-data function lacks a capability check, enabling unauthorized modification of data.

Useful 0 Not Useful 0

Impact Analysis

An attacker with author-level access or above can exploit this vulnerability to reset all configuration data of the FileBird plugin. This could disrupt the organization and management of media library folders, potentially causing data loss or requiring reconfiguration, impacting site functionality and user experience.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if the /filebird/v1/fb-wipe-clear-all-data endpoint is accessible and can be triggered by users with author-level access or above without proper capability checks. Since the vulnerability involves missing permission checks, you can test by attempting to call this REST API endpoint with an authenticated user having author-level permissions and observe if the plugin's configuration data can be reset. Specific commands would involve using curl or similar tools to send authenticated POST requests to the endpoint. For example: curl -X POST -H "Authorization: Bearer <token>" https://yourwordpresssite.com/wp-json/filebird/v1/fb-wipe-clear-all-data. If the request succeeds without proper authorization errors, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the FileBird plugin to a version that includes the fix, which enforces capability checks (manage_options) before allowing data clearance operations. If an update is not immediately available, restrict author-level users from accessing the vulnerable endpoint or disable the plugin temporarily. Additionally, monitor and audit user activities related to the /filebird/v1/fb-wipe-clear-all-data endpoint to detect unauthorized attempts. The fix involves adding permission checks as shown in the changeset that verifies the user has the 'manage_options' capability before allowing data deletion. [2]

Useful 0 Not Useful 0