CVE-2025-2539
File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read
HIGH 7.5EPSS 1.7%
The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Affected
- thomstark · File Away
- CVSS v3.1 WORDFENCE
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- 1.69% chance of exploitation in the next 30 days, 77th percentile
- Nuclei
- high · CWE-327
- Published
- 2025-03-20
- Updated
- 2026-04-08
Proof-of-concept exploits (5)
- whattheslime/file-away-exploit1★ · 2025-03-19
- RootHarpy/CVE-2025-25392★ · 2025-06-04
- Yucaerin/CVE-2025-25390★ · 2025-06-09
- d4rkh0rse/CVE-2025-25390★ · 2025-06-21
- verylazytech/CVE-2025-25394★ · 2025-05-28
Nuclei templates (1)
Security advisories
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5b23bd5c-db27-4d63-8461-1f36958…
- https://plugins.trac.wordpress.org/browser/file-away/trunk/lib/cls/class.fileaway_encrypt…
- https://plugins.trac.wordpress.org/browser/file-away/trunk/lib/cls/class.fileaway_stats.p…
- https://wordpress.org/plugins/file-away/#developers