CVE-2025-2539

published 2025-03-20

CVE-2025-2539: The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to…

Priority P2 76 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

ITW EXPLOIT VulnCheck KEV

The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
file_away_project	file_away	<= 3.9.9.0.1	—
thomstark	file_away	<= 3.9.9.0.1	—

Detection & IOCs extracted from sources · hover to see the quote

url /wp-admin/admin-ajax.php↗

path /wp-content/plugins/file-away/↗

command action=fileaway-stats&nonce={{nonce}}&file=/../../../../../../../../etc/passwd↗

other fileaway_download↗

other application/force-download↗

regex fileaway_stats.*admin-ajax.php","nonce":"([0-9a-zA-Z]+)"}↗

• → Exploit targets the `ajax()` function via the `fileaway-stats` action on wp-admin/admin-ajax.php with no authentication required (missing capability check). Look for unauthenticated POST requests to admin-ajax.php with action=fileaway-stats and a path-traversal string in the `file` parameter. ↗
• → Attacker uses a reversible weak algorithm (CWE-327) to encode the file path. The server responds with a download URL containing a query string; the final GET request returns Content-Type: application/force-download with the file contents. ↗
• → The exploit flow is three-step: (1) GET homepage to extract nonce from inline JS matching `fileaway_stats.*admin-ajax.php`,"nonce":"..."; (2) POST to admin-ajax.php with action=fileaway-stats and path-traversal file param; (3) GET the returned download URL and verify application/force-download content-type and file contents. ↗
• → Presence of the plugin can be fingerprinted via PublicWWW by searching for the string /wp-content/plugins/file-away/ in page source. ↗

• · The nonce value required for exploitation is embedded in the page's inline JavaScript and is dynamically extracted per target; it is not a static value and must be harvested from the victim site's homepage before the exploit POST can be made. ↗
• · The vulnerable code resides in class.fileaway_encrypted.php (weak/reversible encryption) and class.fileaway_stats.php (missing capability check); patched in version 3.9.9.1. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vulncheck 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-327