CVE-2025-2512

File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function

The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected

thomstark · File Away

CVSS v3.1 WORDFENCE

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.97% chance of exploitation in the next 30 days, 61st percentile

Published

2025-03-19

Updated

2026-04-08

Proof-of-concept exploits (1)

• whattheslime/file-away-exploit1★ · 2025-03-19

Security advisories

• https://www.wordfence.com/threat-intel/vulnerabilities/id/9a93313d-a5d7-4109-93c5-b2da26e…
• https://wordpress.org/plugins/file-away/#developers
• https://plugins.trac.wordpress.org/browser/file-away/trunk/lib/cls/class.fileaway_managem…

References

• CVE Record
• NVD entry

Related

• CVE-2024-2473
• CVE-2025-13486
• CVE-2025-2539
• CVE-2026-0740
• CVE-2026-8181