CVE-2025-2539: File Away Project File Away

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products

• File Away Project File Away: up to and including 3.9.9.0.1

Published 2025-03-20. Last modified 2026-06-17.