CVE-2025-12900 is a vulnerability classified under CWE-862 (Missing Authorization) found in the FileBird – WordPress Media Library Folders & File Manager plugin, affecting all versions up to and including 6.5.1. The flaw resides in the ConvertController::insertToNewTable function, where a user-controlled key is not properly validated, resulting in missing authorization checks. This allows authenticated users with author-level access or higher to inject global folders into the media library and reassign arbitrary media attachments to these folders. The vulnerability does not require user interaction and can be exploited remotely over the network. The CVSS 3.1 base score is 4.3 (medium), reflecting low impact on confidentiality and availability but a partial impact on integrity. The scope remains unchanged, and privileges required are low (author-level). No known exploits have been reported in the wild, and no patches are currently linked, indicating the need for vigilance. The vulnerability could be leveraged to manipulate media organization, potentially disrupting workflows or enabling indirect misuse of media assets. Since WordPress is widely used across Europe, especially for content-heavy websites, this vulnerability could affect many organizations relying on the FileBird plugin for media management.

For European organizations, the primary impact of CVE-2025-12900 lies in the integrity of media assets within WordPress sites. Attackers with author-level access can manipulate media folder structures and reassign media files, potentially causing confusion, misplacement of critical media, or indirect reputational damage if media is misrepresented. While confidentiality and availability are not directly affected, the unauthorized modification of media organization can disrupt content management workflows and editorial processes. Organizations with multiple content creators or collaborative environments are particularly vulnerable. This could also facilitate further attacks if media management is linked to other plugins or workflows. Given the widespread use of WordPress in Europe, especially in sectors like media, education, and e-commerce, the vulnerability could have broad implications if exploited at scale.

1. Monitor for plugin updates from the vendor and apply patches promptly once available. 2. Until a patch is released, restrict author-level permissions to trusted users only, minimizing the risk of exploitation. 3. Implement strict access controls and audit logging on WordPress media library changes to detect unauthorized folder injections or media reassignments. 4. Consider disabling or replacing the FileBird plugin if it is not essential or if a secure alternative exists. 5. Use Web Application Firewalls (WAFs) with custom rules to detect anomalous requests targeting the vulnerable function. 6. Educate content authors about the risks of privilege misuse and enforce the principle of least privilege. 7. Regularly review media folder structures and attachments for unexpected changes. 8. Employ security plugins that can monitor and alert on unauthorized changes within WordPress environments.