The FileBird plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of prepared statements on the 'search' parameter. Authenticated attackers with Author-level privileges or above can append malicious SQL queries to existing database queries. This vulnerability enables unauthorized disclosure of sensitive data from the backend database. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at the Author level, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation allows an authenticated user with Author-level access or higher to extract sensitive information from the database by injecting SQL commands. This compromises the confidentiality of the data managed by the WordPress site using the vulnerable FileBird plugin. There is no reported impact on data integrity or availability. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and monitor for unusual database activity related to the FileBird plugin. Avoid using the vulnerable versions of the plugin if possible.