CVE-2024-2346

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads visible. CVE-2024-35166 may be a duplicate of this issue.

• CWE-639
• CWE-639

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060898%40filebird%2Ftrunk&old=3049188%40filebird%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/82cde234-ae87-438f-911e-bdd0e3ac1132?source=cvePatch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060898%40filebird%2Ftrunk&old=3049188%40filebird%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/82cde234-ae87-438f-911e-bdd0e3ac1132?source=cvePatch, Third Party Advisory

Published

May 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23453Android Spoon application version 7.11.1 to 8.6.0 uses hard-…5.5
• CVE-2024-23454Apache Hadoop’s RunJar.run() does not set permissions for te…6.2
• CVE-2024-23456Anti-tampering can be disabled under certain conditions with…7.5
• CVE-2024-23457The anti-tampering functionality of the Zscaler Client Conne…7.8
• CVE-2024-23458While copying individual autoupdater log files, reparse poin…7.8
• CVE-2024-23459An Improper Link Resolution Before File Access ('Link Follow…9.8
• CVE-2024-23460The Zscaler Updater process does not validate the digital si…7.8
• CVE-2024-23461An Improper Validation of Integrity Check Value vulnerabilit…5.5
• CVE-2024-23462An Improper Validation of Integrity Check Value vulnerabilit…7.5
• CVE-2024-23463Anti-tampering protection of the Zscaler Client Connector ca…8.1
• CVE-2024-23464In certain cases, Zscaler Internet Access (ZIA) can be disab…4.9
• CVE-2024-23465The SolarWinds Access Rights Manager was found to be suscept…8.8