CVE-2024-37504 MEDIUM

CVE-2024-37504: WordPress FileBird Document Library plugin <= 2.0.6 - Sensitive Data Exposure vulnerability

Vendor Ninja Team
Product FileBird Document Library
Weakness CWE-200 · Info exposure
Published July 10, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library: from n/a through 2.0.6.

Explanation of Vulnerability in Simple Terms

02Summary

FileBird Document Library versions up to 2.0.6 expose sensitive information that can be accessed over the network without authentication. An attacker can retrieve data that should be restricted, such as file metadata or directory listings. The vulnerability requires no special privileges or user interaction. Update to a version newer than 2.0.6 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Read sensitive file metadata or directory information without logging in.

Potential impact on your site

04Site Impact

Unauthorized users can discover and access information about files and folders stored in FileBird.

Conditions required to exploit

05Prerequisites

Network access to the FileBird Document Library installation; no authentication required.

Key dates

06Disclosure timeline

July 10, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-0950 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data CVE-2026-64874 Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension CVE-2026-7542 Slider Revolution <= 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure CVE-2026-1556 Information disclosure via file URI overwrite in File (Field) Paths CVE-2025-15508 Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure