CVE-2025-11510
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /filebird/v1/fb-wipe-clear-all-data function in all versions up to, and including, 6.4.9. This makes it possible for authenticated attackers, with author-level access and above, to reset all of the plugin's configuration data.
Risk Assessment
Loss of plugin configuration may disrupt media library operation and cause loss of organizational data. This may require time-consuming restoration of settings.
Recommendation
Update the FileBird plugin to a version newer than 6.4.9. Implement additional capability checks for critical administrative functions.
Other vulnerabilities in FileBird
See all- CVE-2026-15004Medium
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to and including 6.5.6 due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2025-12900Medium
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to and including 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user-controlled key. This allows authenticated attackers with author level access and above to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.
Original NVD description (English source)
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /filebird/v1/fb-wipe-clear-all-data function in all versions up to, and including, 6.4.9. This makes it possible for authenticated attackers, with author-level access and above, to reset all of the plugin's configuration data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS