CVE-2024-2346: 
WordPress vulnerability analysis and mitigation

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress contains an Insecure Direct Object Reference vulnerability (CVE-2024-2346) affecting all versions up to and including 5.6.3. The vulnerability was discovered and reported by Tim Coen, with a CVSS v3.1 base score of 5.4 (Medium) (Wordfence).

The vulnerability stems from missing validation on a user-controlled key in the folder deletion functionality. This security flaw has been assigned a CVSS v3.1 Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network accessibility, low attack complexity, and required low privileges (NVD).

When exploited, this vulnerability allows authenticated attackers with author access or higher to delete folders created by other users and expose their file uploads. This compromises the confidentiality and integrity of the media library management system (Wordfence).

The vulnerability requires authentication with author-level access or higher to exploit. The attack vector is network-accessible with low complexity, making it relatively straightforward to exploit for authenticated users (NVD).

Users should update to a version newer than 5.6.3 of the FileBird plugin to address this vulnerability. The fix has been implemented in the WordPress plugin repository (WordPress Plugin).