FileBird – WordPress Media Library Folders & File Manager Security & Risk Analysis

FileBird v6.5.2 presents a mixed security posture. On the positive side, the plugin demonstrates good practices regarding SQL query preparation (81%) and output escaping (97%), significantly reducing the risk of common web vulnerabilities like SQL injection and XSS. The absence of bundled libraries and external HTTP requests also contributes to a more controlled environment. However, a notable concern is the presence of one unprotected AJAX handler, which represents a direct entry point without proper authentication checks, posing a potential risk for unauthorized actions.

The vulnerability history is a significant red flag. With 10 known CVEs, including one critical and nine medium severity issues, the plugin has a history of security weaknesses. While currently unpatched CVEs are zero, the recurring types of vulnerabilities (Missing/Improper Authorization, XSS, SQL Injection, Authorization Bypass) suggest persistent coding flaws or an inability to fully address certain security concerns. The taint analysis, though limited in scope, did identify one flow with an unsanitized path, which, if exploitable, could lead to security issues. The plugin's total attack surface is moderate, but the single unprotected entry point is a critical weakness.