CVE-2025-2539

🗓️ 20 Mar 2025 11:11:26Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 116 Views🌐 WEB

File Away plugin for WordPress is vulnerable to unauthorized data access due to missing checks.

Reporter	Title	Published	Views	Family All 19
GithubExploit	Exploit for Use of a Broken or Risky Cryptographic Algorithm in File_Away_Project File_Away	13 Dec 202506:27	–	githubexploit
GithubExploit	Exploit for Use of a Broken or Risky Cryptographic Algorithm in File_Away_Project File_Away	4 Jun 202507:27	–	githubexploit
GithubExploit	Exploit for Use of a Broken or Risky Cryptographic Algorithm in File_Away_Project File_Away	21 Jun 202506:51	–	githubexploit
GithubExploit	Exploit for Use of a Broken or Risky Cryptographic Algorithm in File_Away_Project File_Away	10 Oct 202500:28	–	githubexploit
GithubExploit	Exploit for Use of a Broken or Risky Cryptographic Algorithm in File_Away_Project File_Away	26 May 202512:06	–	githubexploit
Circl	CVE-2025-2539	20 Mar 202515:03	–	circl
CNNVD	WordPress plugin File Away 加密问题漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-2539 File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read	20 Mar 202511:11	–	cvelist
Nuclei	File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read	29 Jun 202605:52	–	nuclei
NVD	CVE-2025-2539	20 Mar 202512:15	–	nvd

NVD

Vulners

Node

file_away_project file_awayRange≤3.9.9.0.1wordpress

[
  {
    "vendor": "thomstark",
    "product": "File Away",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.9.9.0.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/file-away/trunk/lib/cls/class.fileaway_stats.php
plugins	www.plugins.trac.wordpress.org/browser/file-away/trunk/lib/cls/class.fileaway_encrypted.php
github	www.github.com/whattheslime/file-away-exploit
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5b23bd5c-db27-4d63-8461-1f36958a2ff6
wordpress	www.wordpress.org/plugins/file-away/

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Unauthenticated access via the fileaway-stats AJAX endpoint allowing arbitrary file read.	CWE-327
nonce	request body	wp-admin/admin-ajax.php	Unauthenticated access via the fileaway-stats AJAX endpoint allowing arbitrary file read.	CWE-327
file	request body	wp-admin/admin-ajax.php	Unauthenticated access via the fileaway-stats AJAX endpoint allowing arbitrary file read.	CWE-327

17 Jun 2026 09:07Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.0155

SSVC