CVE-2025-11510: FileBird WordPress Plugin Auth Bypass

CVE-2025-11510 Overview

CVE-2025-11510 is a missing authorization vulnerability in the FileBird – WordPress Media Library Folders & File Manager plugin. The flaw affects all versions up to and including 6.4.9. The plugin fails to enforce a capability check on the /filebird/v1/fb-wipe-clear-all-data REST endpoint. Authenticated attackers with author-level access or above can invoke the function to reset the plugin's configuration data. The issue is classified as [CWE-285] Improper Authorization.

Critical Impact

Any authenticated user with author privileges or higher can wipe all FileBird plugin configuration data, disrupting media library organization across the affected WordPress site.

Affected Products

• FileBird – WordPress Media Library Folders & File Manager plugin, versions ≤ 6.4.9
• WordPress sites where the plugin is installed and active
• Any environment permitting author-level or higher user registrations that trust the plugin's configuration state

Discovery Timeline

• 2025-10-18 - CVE-2025-11510 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11510

Vulnerability Analysis

The FileBird plugin exposes a REST route at /filebird/v1/fb-wipe-clear-all-data intended to reset stored plugin data. The route's callback lacks a current_user_can() capability verification. WordPress therefore permits any authenticated request that passes nonce and authentication checks to reach the handler. Because author-level accounts are commonly granted on multi-author sites, the exposure extends beyond administrators. Successful invocation clears folder structures, category mappings, and other stored plugin state used to organize media assets. The resulting loss of organization can affect editorial workflows, content publishing, and any downstream systems that reference FileBird folder identifiers.

Root Cause

The root cause is a missing capability check on a state-mutating REST endpoint. The permission_callback for the fb-wipe-clear-all-data route accepts any authenticated user rather than restricting access to users with administrative capabilities such as manage_options. This design decision violates the WordPress REST API guidance that destructive operations require explicit privilege verification. The vendor's patch in includes/Classes/Convert.php adds the missing capability enforcement, as recorded in the WordPress Plugin Change Log.

Attack Vector

Exploitation requires network access to the WordPress REST API and a valid author-or-above account. An attacker authenticates, obtains a valid REST nonce from the WordPress admin surface, and issues an authenticated request to the vulnerable endpoint. No user interaction from an administrator is required. Confidentiality is not affected; integrity of plugin configuration is impacted; availability of the organized media library structure is degraded until data is restored from backup.

No verified proof-of-concept code is published in the referenced advisories. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-11510

Indicators of Compromise

• HTTP requests to the path /wp-json/filebird/v1/fb-wipe-clear-all-data originating from author-level or contributor-adjacent accounts
• Sudden loss of FileBird folder hierarchies or category assignments in the WordPress media library
• Web server access logs showing POST or DELETE traffic to the vulnerable REST route outside of administrator sessions

Detection Strategies

• Review WordPress REST API access logs for calls to filebird/v1/fb-wipe-clear-all-data and correlate the authenticated user's role
• Deploy web application firewall rules that flag or block non-administrator requests to the affected endpoint
• Compare current FileBird database tables against periodic snapshots to identify unexpected truncation events

Monitoring Recommendations

• Enable audit logging for author, editor, and contributor accounts on multi-author WordPress deployments
• Alert on plugin configuration changes recorded in wp_options and FileBird-specific tables
• Monitor for unusual REST API activity patterns from accounts that do not typically use administrative endpoints

How to Mitigate CVE-2025-11510

Immediate Actions Required

• Update the FileBird plugin to the version that includes the fix referenced in changeset 3379856
• Audit user accounts and revoke author-or-above privileges that are no longer required
• Back up FileBird configuration tables so that a wipe event can be quickly reversed

Patch Information

The vendor addressed the issue in the FileBird plugin release that follows version 6.4.9. The corrective commit adds a capability check to the affected REST callback in includes/Classes/Convert.php. Site operators should upgrade through the WordPress plugin installer or by deploying the patched release from the WordPress Plugin Change Log.

Workarounds

• Restrict access to /wp-json/filebird/v1/* at the reverse proxy or WAF layer to administrator IP ranges until patching is complete
• Temporarily deactivate the FileBird plugin on sites that cannot be upgraded immediately
• Downgrade untrusted author accounts to contributor role, which lacks the authenticated context required for exploitation

# Example Nginx rule to restrict the vulnerable endpoint by source IP
location ~ ^/wp-json/filebird/v1/fb-wipe-clear-all-data {
    allow 203.0.113.10;   # administrator workstation
    deny all;
}