FileBird – WordPress Media Library Folders & File Manager <= 6.5.8 - Authenticated (Contributor+) Missing Authorization to Other Users' Folder Move, Duplication and Color Change
- ID
- WPSEC-2026-0972
- Plugin
- FileBird – WordPress Media Library Folders & File Manager (filebird)
- Affected
- all versions before 6.5.9
- Remediation
- Update to 6.5.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- FileBird – WordPress Media Library Folders & File Manager on WPSec AttackSurface
- Fix released
- Published
Description
The FileBird plugin for WordPress is vulnerable to unauthorized modification of data via the pt-update-tree, pt-duplicate-folder, pt-set-folder-color and update-folder-color REST endpoints in all versions up to, and including, 6.5.8, due to missing folder ownership checks in the restPtUpdateFolder, restPtDuplicateFolder, restSetFolderColor and updateFolderColor functions. This makes it possible for authenticated attackers with Contributor-level access and above, on sites where each user has their own folders, to move other users' post and page folders to a different parent, duplicate other users' folders into those users' trees, and change folder colors. Changing media folder colors requires Author-level access.
References
- https://wpsec.com/vuln/WPSEC-2026-0972/
- https://plugins.svn.wordpress.org/filebird/tags/6.5.9/
- https://wordpress.org/plugins/filebird/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS