FileBird WordPress Plugin Improper Authorization Vulnerability Allowing Settings Reset

A vulnerability exists in the FileBird WordPress plugin, specifically in the Media Library Folders & File Manager version 6.4.9 and prior. The issue arises from a lack of proper capability checks in the '/filebird/v1/fb-wipe-clear-all-data' function. This flaw enables authenticated attackers with author-level access or higher to unauthorizedly modify data by resetting all configuration settings of the plugin.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the plugin's data, specifically resetting all configuration settings to their defaults.

Remediation

Users can update to FileBird version 6.5.0 or a newer patched version to address this vulnerability.