{
 "id": "WPSEC-2026-0972",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0972/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0972/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0972/index.md",
 "title": "FileBird – WordPress Media Library Folders & File Manager <= 6.5.8 - Authenticated (Contributor+) Missing Authorization to Other Users' Folder Move, Duplication and Color Change",
 "description": "The FileBird plugin for WordPress is vulnerable to unauthorized modification of data via the pt-update-tree, pt-duplicate-folder, pt-set-folder-color and update-folder-color REST endpoints in all versions up to, and including, 6.5.8, due to missing folder ownership checks in the restPtUpdateFolder, restPtDuplicateFolder, restSetFolderColor and updateFolderColor functions. This makes it possible for authenticated attackers with Contributor-level access and above, on sites where each user has their own folders, to move other users' post and page folders to a different parent, duplicate other users' folders into those users' trees, and change folder colors. Changing media folder colors requires Author-level access.",
 "plugin": {
  "slug": "filebird",
  "name": "FileBird – WordPress Media Library Folders & File Manager",
  "full_name": "FileBird – WordPress Media Library Folders & File Manager",
  "wordpress_org": "https://wordpress.org/plugins/filebird/",
  "advisories_url": "https://wpsec.com/vuln/plugin/filebird/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/filebird"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.5.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.5.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.5.9",
 "remediation": "Update to 6.5.9 or later.",
 "fix_released": "2026-10-13T20:28:39+00:00",
 "published": "2026-10-14T20:43:57+00:00",
 "updated": "2026-10-14T14:17:44.734384+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0972/",
  "https://plugins.svn.wordpress.org/filebird/tags/6.5.9/",
  "https://wordpress.org/plugins/filebird/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/filebird",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}