PatchTheCVECVE-2025-2539: The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch
CVE-2025-2539 is a high-severity flaw (CVSS 7.5) affecting file away. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read the contents of arbitrary files on the server, which can contain sensitive information.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.7% (top 23%) |
| CISA exploited list | No |
| Weakness | CWE-327 |
| Published | 2025-03-20 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-2539?
file away: upgrade to newer than 3.9.9.0.1. Exact commands for each OS are on this page.
Is CVE-2025-2539 being exploited?
CVE-2025-2539 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-2539 affect?
CVE-2025-2539 affects file away. Severity is high (CVSS 7.5). The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers,
How urgent is CVE-2025-2539?
Priority 50/100. High severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-2512 CRITICAL 9.8 UPGRADE The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check a