WordPress Filebird plugin users can exploit an Authorization Bypass Through User-Controlled Key flaw that permits unauthorized access to private files or configuration data. The vulnerability arises from incorrectly configured access control security levels, enabling attackers to target resources by manipulating request parameters or URLs. While the severity is moderate (CVSS 3.8), an attacker who succeeds could read or modify data they are not authorized to access, potentially compromising site integrity or exposing sensitive information.

The issue affects the Ninja Team Filebird plugin for WordPress, specifically all releases up to and including version 6.4.2.1. Sites utilizing these versions of the plugin are vulnerable unless an upgrade has been applied.

The CVSS score of 3.8 indicates moderate risk, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited known exploitation. Attackers can trigger the IDOR by crafting URLs or request parameters that reference file identifiers, bypassing normal authorization checks. Because the flaw relies on misconfigured access controls, any site that has granted broader file access may be particularly susceptible.