The FileBird WordPress plugin suffers from a missing authorization vulnerability (CWE-862) in the ConvertController::insertToNewTable function. This flaw allows authenticated users with author-level privileges or above to manipulate folder assignments of media files by injecting global folders and reassigning arbitrary media attachments. The vulnerability is present in all versions up to 6.5.1. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring privileges but no user interaction. The impact is limited to integrity, with no confidentiality or availability impact reported.

An attacker with author-level access or higher can exploit this vulnerability to alter the organization of media files by injecting global folders and reassigning media attachments. This could lead to unauthorized modification of media folder structures, potentially disrupting content management workflows. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict author-level access to trusted users only to reduce risk.