CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads visible. CVE-2024-35166 may be a duplicate of this issue.
Explanation of Vulnerability in Simple Terms
FileBird versions up to 5.6.3 contain an authorization flaw that allows authenticated users with low privileges to read and modify files they should not have access to. The vulnerability affects the WordPress media library folder management system. An attacker with a basic user account can bypass folder permission checks to view or alter media files belonging to other users or restricted folders.
What an attacker can do
Read and modify media files in folders they don't have permission to access.
Potential impact on your site
Unauthorized users can view, download, or modify media files across your site, potentially exposing sensitive images or documents.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., Contributor or Author role).
Key dates
External resources
Related vulnerabilities
