The FileBird WordPress media library plugin contains a SQL injection vulnerability that permits authenticated users with Author level or higher to insert arbitrary SQL into the 'search' parameter. This flaw arises from insufficient escaping and the absence of prepared statements surrounding the query. If exploited, the attacker can read sensitive records from the database, potentially revealing usernames, passwords, and other confidential information.

WordPress sites running the FileBird – WordPress Media Library Folders & File Manager plugin up to and including version 6.4.8 are affected. Any installation of this plugin within that version range must be reviewed to determine whether the plugin is present and the user roles include Author or higher.

The CVSS score of 6.5 reflects a medium severity, and the EPSS score of less than 1% indicates a very low probability of existing exploits at this time. The flaw is not listed in the CISA KEV catalog. Because the flaw requires authenticated access, the typical attack vector would involve a legitimate user account with sufficient privileges, such as a site author, who can issue a crafted search request. Even though the exploitation window is limited, the potential impact of compromising database contents warrants prompt attention.