CVE-2025-66134: 
WordPress vulnerability analysis and mitigation

CVE-2025-66134 is a Missing Authorization (Broken Access Control) vulnerability in NinjaTeam's FileBird Pro WordPress plugin. It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels, affecting FileBird Pro versions up to and including 6.5.1 (initially reported as affecting through 6.4.9, later updated). The vulnerability was disclosed on December 16, 2025, by Patchstack, and carries a CVSS v3.1 base score of 5.4 (Medium) (NVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain actions. The attack vector is network-based, requires low privileges (an authenticated WordPress user account), and no user interaction. The vulnerability allows exploitation of incorrectly configured access control security levels within the plugin's functionality, potentially enabling unauthorized manipulation of media library folders or related plugin operations (NVD, Patchstack).

Successful exploitation results in limited integrity and availability impacts, with no confidentiality impact according to the CVSS scoring. An authenticated attacker could perform unauthorized actions within the FileBird Pro plugin — such as modifying or deleting media folder structures — without having the required permissions. The scope is limited to the affected WordPress installation and does not directly enable lateral movement or sensitive data exposure (NVD).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-66134. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. Exploitation requires a valid (low-privilege) WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (NVD).

Users should update FileBird Pro to a version beyond 6.5.1, which is the last confirmed vulnerable version. The fix was initially associated with version 6.4.9 and later updated to reflect 6.5.1 as the boundary. Site administrators should review user roles and restrict plugin access to trusted accounts only as an interim measure. Monitor the NinjaTeam and Patchstack advisories for the specific patched release version (NVD, Patchstack).