Exploitation Research Plan: CVE-2025-12900 (FileBird Global Folder Tampering)

1. Vulnerability Summary

The FileBird – WordPress Media Library Folders & File Manager plugin (up to version 6.5.1) is vulnerable to Missing Authorization. The vulnerability exists in the ConvertController::insertToNewTable function, which fails to properly validate a user-controlled key and lacks sufficient capability checks. This allows authenticated users with Author level access or higher to inject global folders and reassign arbitrary media attachments to these folders, bypassing intended access controls.

2. Attack Vector Analysis

• Endpoint: admin-ajax.php (AJAX action handler).
• Vulnerable Action: fbv_insert_to_new_table (inferred from function name insertToNewTable).
• HTTP Parameter: Likely key or plugin (used to specify the source of data for conversion) and folders/attachments data.
• Authentication: Author+ level required (PR:L).
• Precondition: The site must have the FileBird plugin active. The exploit targets the logic intended for migrating data from other folder plugins into FileBird's structure.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX action, likely via add_action('wp_ajax_fbv_insert_to_new_table', ...).
2. Controller: The action maps to FileBird\Controller\ConvertController::insertToNewTable.
3. Missing Check: Inside insertToNewTable, the code likely checks for a valid nonce but fails to verify if the user has the manage_options capability (required for global settings/folders).
4. Processing: The function uses a user-provided key (referencing a source plugin like 'enhanced-media-library') to fetch data and insert it into FileBird's own database tables (fbv and fbv_attachment_folder).
5. Sink: The code performs SQL INSERT operations or uses $wpdb to create new folder entries marked as global (usually created_by = 0 or a specific flag) and links existing attachment_ids to these new folder IDs.

4. Nonce Acquisition Strategy

FileBird typically exposes its AJAX nonce in the WordPress admin dashboard, particularly on the Media Library page.

1. Shortcode/Page: No specific shortcode is needed; the plugin loads on the standard Media Library page (/wp-admin/upload.php).
2. Navigation: Navigate to the Media Library as an Author user.
3. Variable Identification: FileBird usually localizes data under the filebird_php_obj or fbv_data JavaScript variable.
4. Browser Eval:

   // Use browser_eval to find the nonce
   window.filebird_php_obj?.nonce || window.fbv_data?.nonce
   

5. Action String: The nonce is likely created with the action 'fbv_nonce' or 'filebird_nonce'.

5. Exploitation Strategy

The goal is to trigger the conversion process with a payload that defines a new global folder and reassigns attachments (even those not owned by the Author) to it.

Target URL: http://[target]/wp-admin/admin-ajax.php

Payload Construction:

• action: fbv_insert_to_new_table (or the specific AJAX action mapped to the function).
• nonce: [Extracted Nonce]
• key: A string identifying the "source" plugin to "convert" from. Attackers may need to provide a key that the plugin recognizes (e.g., wpuxo_eml for Enhanced Media Library).
• folders: (If the function accepts raw folder data) A JSON or array structure defining a folder name.

Example HTTP Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=fbv_insert_to_new_table&nonce=[NONCE]&key=wpuxo_eml&new_folders[0][name]=pwned_global_folder&new_folders[0][parent]=0

Note: Since this vulnerability involves "Global Folders Tampering," the exploit likely involves manipulating the conversion logic to treat the Author's input as legitimate migration data that should be applied globally.

6. Test Data Setup

1. User: Create a user with the Author role.
2. Media: Upload several images as the Administrator (to ensure the Author does not own them).
3. Plugin Config: Ensure FileBird is installed and active. It is not necessary for the "source" plugin (e.g., Enhanced Media Library) to actually be installed if the vulnerable function doesn't check for the plugin's presence before attempting database operations based on the key.

7. Expected Results

• The AJAX response should return a success status (e.g., {"success": true}).
• A new folder named "pwned_global_folder" (or similar) will appear in the Media Library for all users.
• Attachments specified in the payload (or all attachments if the "conversion" logic is broad) will be moved into this folder.

8. Verification Steps

1. Database Check:

   wp db query "SELECT * FROM wp_fbv WHERE name='pwned_global_folder';"
   

   Check if the created_by column is 0 (indicating a global folder) or if it's visible across different user accounts.
2. Attachment Check:
   Verify the relationship in the mapping table:

   wp db query "SELECT * FROM wp_fbv_attachment_folder WHERE folder_id=(SELECT id FROM wp_fbv WHERE name='pwned_global_folder' LIMIT 1);"
   

3. UI Check: Log in as a different user (e.g., Editor) and verify the new folder is visible in the Media Library.

9. Alternative Approaches

• Source Plugin Simulation: If the function requires actual data in the source plugin's tables, use wp db query to manually insert dummy data into the tables expected by the key (e.g., Enhanced Media Library's tables) before calling the FileBird conversion function.
• Key Fuzzing: If wpuxo_eml is not the correct key, look for other supported plugins in the source code of ConvertController.php (e.g., eml, wpmf, folder, premio).
• REST API: Check if ConvertController methods are also exposed via the REST API under the wp-json/filebird/v1/ namespace, which might have similar authorization flaws.