CVE-2025-2539

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada file away project file away. Skor CVSS 3.1 7.5 (High) menurut wordfence.com.

Deskripsi (NVD)

The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read the contents of arbitrary files on the server, which can contain sensitive information.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wordfence.com/threat-intel/vulnerabilities/id/5b23bd5c-db27-4d63-8461-1f36958a2ff6?source=cve advisory pihak ketiga
• https://github.com/whattheslime/file-away-exploit?tab=readme-ov-file
• https://plugins.trac.wordpress.org/browser/file-away/trunk/lib/cls/class.fileaway_encrypted.php product
• https://plugins.trac.wordpress.org/browser/file-away/trunk/lib/cls/class.fileaway_stats.php product
• https://wordpress.org/plugins/file-away/#developers product