CVE-2025-66134

Executive Summary

CVE-2025-66134 is a Missing Authorization vulnerability in the WordPress plugin FileBird Pro by NinjaTeam, affecting versions up to and including 6.5.1. This flaw allows an authenticated attacker (with low privileges) to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to protected resources or actions. The vulnerability is classified as CWE-862: Missing Authorization and carries a CVSS score of 5.4 (Medium). As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Organizations using FileBird Pro should treat this as a supply chain risk, as the plugin is a third-party component integrated into the WordPress ecosystem. No known malicious packages or compromised updates have been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid WordPress user account (e.g., subscriber).
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality Impact (C): Low (L) – Limited data exposure.
• Integrity Impact (I): Low (L) – Limited ability to modify data.
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability requires authentication but is trivial to exploit once access is obtained. It could lead to unauthorized viewing or modification of media library data managed by FileBird Pro.

Deep Dive & Mechanics

FileBird Pro is a WordPress plugin that organizes media library files into folders. The vulnerability lies in the plugin's REST API endpoints or AJAX handlers that fail to properly verify user capabilities before executing sensitive operations. Specifically, functions that allow folder creation, deletion, renaming, or file assignment do not check if the current user has the required edit_posts or upload_files capability. This allows any authenticated user (e.g., subscriber) to perform actions intended only for editors or administrators.

The missing authorization check is likely in the filebird-pro/includes/classes/class-fb-rest-api.php or similar controller files. The plugin uses WordPress REST API routes like /filebird/v1/folder/create or /filebird/v1/folder/delete without enforcing capability checks via current_user_can().

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. A patched version would include proper capability checks.

Vulnerable Code (Example from class-fb-rest-api.php):

register_rest_route( 'filebird/v1', '/folder/create', array(
    'methods' => 'POST',
    'callback' => array( $this, 'create_folder' ),
    'permission_callback' => '__return_true', // Missing authorization check
) );

Patched Code (Hypothetical):

register_rest_route( 'filebird/v1', '/folder/create', array(
    'methods' => 'POST',
    'callback' => array( $this, 'create_folder' ),
    'permission_callback' => function() {
        return current_user_can( 'edit_posts' ); // Proper capability check
    },
) );

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: A WordPress site with FileBird Pro <= 6.5.1 installed and a low-privilege user account (e.g., subscriber).
2. Steps:
   • Authenticate to WordPress and obtain a nonce or cookie.
   • Send a crafted POST request to the vulnerable REST API endpoint:

     POST /wp-json/filebird/v1/folder/create HTTP/1.1
     Host: target-site.com
     Content-Type: application/json
     Cookie: wordpress_logged_in_xxx=...
     
     {"name":"malicious_folder","parent":0}
     

   • If successful, the folder is created despite the user lacking edit_posts capability.
3. Impact: Unauthorized folder manipulation, potential data exposure if folders contain sensitive media.

Blue Team (Defense & Detection)

1. Monitor REST API Access: Log all requests to /wp-json/filebird/v1/* and alert on low-privilege users (subscriber, contributor) making POST/PUT/DELETE requests.
2. Audit User Capabilities: Regularly review user roles and ensure only trusted roles have edit_posts or upload_files.
3. Web Application Firewall (WAF): Create rules to block requests to FileBird Pro endpoints from users with insufficient roles.
4. Honeypot: Deploy a fake folder creation endpoint to detect scanning.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-json/filebird/v1/folder/create or /wp-json/filebird/v1/folder/delete from low-privilege users.
• Logs: WordPress debug log entries showing rest_authentication_errors or failed capability checks.
• File System: Unexpected folders in the WordPress media library created by non-admin users.
• Database: Entries in wp_fbv (FileBird folder table) with created_by column showing low-privilege user IDs.

Detection Engineering

YARA Rule

rule CVE_2025_66134_FileBird_Pro_Missing_Auth {
    meta:
        description = "Detects vulnerable FileBird Pro plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66134"
    strings:
        $rest_route = /register_rest_route\s*\(\s*['\"]filebird\/v1['\"]/
        $permission_callback = /'permission_callback'\s*=>\s*'__return_true'/
    condition:
        $rest_route and $permission_callback
}

Sigma Rule

title: FileBird Pro Missing Authorization Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-66134 by low-privilege users accessing FileBird Pro REST API endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|startswith: '/wp-json/filebird/v1/'
        cs-username|contains: 
            - 'subscriber'
            - 'contributor'
            - 'author'
    condition: selection
falsepositives:
    - Legitimate admin actions from misconfigured roles
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66134 FileBird Pro Missing Authorization Exploit";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-json/filebird/v1/";
    http_uri;
    pcre:"/\/wp-json\/filebird\/v1\/(folder|file)\/(create|delete|rename|move)/i";
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable or remove the FileBird Pro plugin until a patch is released.
2. Workaround: Implement a custom plugin or mu-plugin that adds capability checks to the vulnerable REST API endpoints:

   add_filter( 'rest_pre_dispatch', function( $result, $server, $request ) {
       if ( strpos( $request->get_route(), 'filebird/v1' ) !== false ) {
           if ( ! current_user_can( 'edit_posts' ) ) {
               return new WP_Error( 'rest_forbidden', 'You do not have permission.', array( 'status' => 403 ) );
           }
       }
       return $result;
   }, 10, 3 );
   

3. Long-term: Monitor the NinjaTeam website for an official patch and apply it immediately.
4. User Role Audit: Restrict low-privilege roles from accessing the media library if not required.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst