Thomstark File Away vulnerabilities
2 known vulnerabilities affecting thomstark/file_away.
Total CVEs
2
CISA KEV
0
Public exploits
1
Exploited in wild
1
Severity breakdown
CRITICAL1HIGH1
Vulnerabilities
Page 1 of 1
CVE-2025-2539P2HIGHCVSS 7.5ExploitedPoC≤ 3.9.9.0.12025-03-20
CVE-2025-2539 [HIGH] CWE-327 CVE-2025-2539: The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing cap
The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read the contents of arbitrary files on the server, which can
nvd
CVE-2025-2512P2CRITICALCVSS 9.8≤ 3.9.9.0.12025-03-19
CVE-2025-2512 [CRITICAL] CWE-434 CVE-2025-2512: The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capabili
The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code
nvd