Unauthorized Data Access in File Away Plugin for WordPress
CVE-2025-2539
7.5HIGH
What is CVE-2025-2539?
The File Away plugin for WordPress suffers from a vulnerability that allows unauthorized access to sensitive data. This is due to a missing capability check on the ajax() function present in all versions up to and including 3.9.9.0.1. Exploiting this vulnerability enables unauthenticated attackers to leverage a reversible weak algorithm to read arbitrary files on the server, potentially exposing confidential information stored within those files.
Affected Version(s)
File Away * <= 3.9.9.0.1
References
EPSS Score
9% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
SĂ©lim Lanouar