Critical severity9.8NVD Advisory· Published Jul 12, 2021· Updated Jun 17, 2026
CVE-2021-24385
CVE-2021-24385
Description
The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: <=4.7.3
- Ninja Team/FileBird – WordPress Media Library Folders & File Managerv5Range: 4.7.3
Patches
Vulnerability mechanics
References
2- wpscan.com/vulnerability/754ac750-0262-4f65-b23e-d5523995fbfanvdExploitThird Party Advisory
- 10up.com/blog/2021/security-vulnerability-filebird-wordpress-plugin/nvdThird Party Advisory
News mentions
0No linked articles in our index yet.