CVE-2025-12900
Authorization Bypass in FileBird Plugin Enables Media Folder Manipulation
Publication date: 2025-12-15
Last updated on: 2025-12-15
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ninja_team | filebird | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the FileBird WordPress plugin allows authenticated users with author-level access or higher to exploit missing authorization checks in the "ConvertController::insertToNewTable" function. This flaw lets them inject global folders and reassign arbitrary media attachments to those folders by manipulating a user-controlled key, potentially altering media organization without proper permissions.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers with author-level access to manipulate the media library structure, injecting global folders and reassigning media attachments arbitrarily. This could lead to unauthorized changes in media organization, potentially causing confusion, mismanagement of media assets, or indirect impacts on site content presentation and management.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if your WordPress site is running the FileBird plugin version 6.5.1 or earlier, as these versions lack proper authorization checks. You can verify the plugin version via the WordPress admin dashboard or by running the following command in your WordPress installation directory: `wp plugin list | grep filebird`. Additionally, monitoring for unusual folder creation or media attachment reassignment activities by users with author-level access or higher may indicate exploitation attempts. Since the vulnerability involves missing authorization in the "ConvertController::insertToNewTable" function, reviewing logs for unauthorized API calls or AJAX requests related to folder insertion or media reassignment could help detect exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the FileBird plugin to version 6.5.2 or later, which includes fixes for this vulnerability by enforcing unique folder names, adding authorization checks (such as `current_user_can('manage_options')`), and verifying folder authorship before allowing modifications. If updating immediately is not possible, restrict author-level users' permissions to prevent folder creation or media reassignment until the patch can be applied. Additionally, monitor and audit user activities related to folder management to detect and prevent unauthorized changes. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.