What is CVE-2025-12900?

CVE-2025-12900 is a medium-severity vulnerability in Ninjateam Filebird – WordPress Media Library Folders & File Manager, classified under Missing Authorization. CVSS score: 4.3/10. Published 2025-12-15.

How severe is CVE-2025-12900?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Ninjateam Filebird – WordPress Media Library Folders & File Manager

CVE-2025-12900

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author level access and above, to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.

Vulnerability class: Broken Access Control

EPSS: 0.002 (13.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Ninjateam Filebird – Wordpress Media Library Folders & File Manager — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2025-12900?: CVE-2025-12900 is a medium-severity vulnerability in Ninjateam Filebird – WordPress Media Library Folders & File Manager, classified under Missing Authorization. CVSS score: 4.3/10. Published 2025-12-15.
How severe is CVE-2025-12900?: Medium severity. CVSS v3 base score is 4.3 out of 10.