CVE-2024-2346 Missing authorization in FileBird – WordPress Media Library Folders & File Manager

Medium 5.4 Published 2 May 2024 Updated 8 Apr 2026

Authenticated attackers with author access can delete other users' folders and expose their file uploads due to missing validation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-2346?

CVE-2024-2346 is a medium-severity missing authorization vulnerability in ninjateam FileBird – WordPress Media Library Folders & File Manager, published on 2 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads visible. CVE-2024-35166 may be a duplicate of this issue.

Weakness: CWE-639

Which versions are affected by CVE-2024-2346?

It affects 1 product.

Products include Ninjateam Filebird.

How do I fix CVE-2024-2346?

No fix has been published for CVE-2024-2346 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-2346 being exploited?

There is no known exploitation of CVE-2024-2346 in the wild and no public exploit code.

Sources

Also known as GHSA-92qm-mq2f-95w2.