The FileBird WordPress Media Library plugin contains a missing capability check on the REST endpoint /filebird/v1/fb-wipe-clear-all-data. An authenticated user with author or higher privileges can invoke this endpoint to wipe and reset all plugin configuration data, effectively erasing the organization of media folders and settings. This is an unauthorized modification flaw, classified as CWE-285, that compromises integrity of plugin data but does not grant arbitrary code execution or direct visibility of sensitive site content.

Any WordPress installation using FileBird version 6.4.9 or earlier, provided users have author role or higher permissions in the site. The vulnerability affects the FileBird – WordPress Media Library Folders & File Manager plugin from ninjateam.

The vulnerability scores a CVSS of 4.3, indicating a medium impact. The EPSS score of less than 1% suggests that exploit attempts are relatively rare. It is not listed in CISA KEV catalogs. The attack requires authenticated author-level access to the site, making it a local privilege escalation within the WordPress administrative context. Due to the low exploitation probability but moderate severity, organizations should consider mitigations promptly.