PT-2025-11678 · WordPress · File Away

Sélim Lanouar

·

Published

2025-03-19

·

Updated

2026-01-15

·

CVE-2025-2512

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions File Away plugin for WordPress versions up to, and including, 3.9.9.0.1
Description The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.
Recommendations For versions up to, and including, 3.9.9.0.1, consider disabling the upload() function until a patch is available. Restrict access to the upload functionality to minimize the risk of exploitation. Avoid using the File Away plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-2512

Affected Products

File Away