# FileBird – WordPress Media Library Folders & File Manager <= 6.5.8 - Authenticated (Contributor+) Missing Authorization to Other Users' Folder Move, Duplication and Color Change

- **ID:** WPSEC-2026-0972
- **Plugin:** FileBird – WordPress Media Library Folders & File Manager (`filebird`), https://wordpress.org/plugins/filebird/
- **Affected versions:** all versions before 6.5.9
- **Fixed in:** 6.5.9 (Update to 6.5.9 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/filebird
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0972/

## Description

The FileBird plugin for WordPress is vulnerable to unauthorized modification of data via the pt-update-tree, pt-duplicate-folder, pt-set-folder-color and update-folder-color REST endpoints in all versions up to, and including, 6.5.8, due to missing folder ownership checks in the restPtUpdateFolder, restPtDuplicateFolder, restSetFolderColor and updateFolderColor functions. This makes it possible for authenticated attackers with Contributor-level access and above, on sites where each user has their own folders, to move other users' post and page folders to a different parent, duplicate other users' folders into those users' trees, and change folder colors. Changing media folder colors requires Author-level access.

## References

- https://wpsec.com/vuln/WPSEC-2026-0972/
- https://plugins.svn.wordpress.org/filebird/tags/6.5.9/
- https://wordpress.org/plugins/filebird/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0972/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.