CVE-2025-2512 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Missing **capability checks** and **file type validation** in the `upload` function. 🔍 **CWE**: CWE-434 (Unrestricted Upload of File with Dangerous Type). The code blindly trusts user input. ⚠️

Q: Who is affected? (Versions/Components)

📦 **Affected Product**: WordPress Plugin **File Away**. 👤 **Vendor**: thomstark. 📅 **Version**: **3.9.9.0.1** and **earlier** versions. If you use this, you are at risk! 🚩

Q: What can hackers do? (Privileges/Data)

💀 **Attacker Power**: Upload arbitrary files. 🔓 **Privileges**: Achieve **Remote Code Execution (RCE)**. 📊 **Impact**: High Confidentiality, Integrity, and Availability loss. Full server control! 🏴☠️

Q: Is exploitation threshold high? (Auth/Config)

🚪 **Threshold**: **LOW**. 🔑 **Auth**: No authentication required (`PR:N`). 🌐 **Network**: Network accessible (`AV:N`). 👀 **UI**: No user interaction needed (`UI:N`). Easy to exploit! ⚡

Q: Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploit**: Yes. 🔗 **Reference**: GitHub repo `whattheslime/file-away-exploit` exists. 🌍 **Wild Exploitation**: Likely active given the low barrier. Check WordFence intel for active threats. 🕵️♂️

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: Update to the **latest version** immediately. 📢 **Source**: Check WordPress.org plugin page or vendor site. ⏳ **Status**: Published 2025-03-19. Patch likely available now. Don't wait! ⏰

Q: What if no patch? (Workaround)

🚧 **No Patch?**: Disable the plugin immediately. 🗑️ **Action**: Delete or deactivate **File Away**. 🔒 **Mitigation**: Block upload endpoints via WAF if possible. Remove risk until updated. 🛑

Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. 📈 **Priority**: **P0**. 💡 **Reason**: Unauthenticated RCE via simple file upload. Fix NOW to prevent breach. Time is ticking! ⏳

Updated May 08, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: File Away plugin allows **unrestricted file uploads**. <br>💥 **Consequences**: Attackers can upload **any file** (e.g., webshells).…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Missing **capability checks** and **file type validation** in the `upload` function. <br>🔍 **CWE**: CWE-434 (Unrestricted Upload of File with Dangerous Type). The code blindly trusts user input. ⚠️

Q3Who is affected? (Versions/Components)

📦 **Affected Product**: WordPress Plugin **File Away**. <br>👤 **Vendor**: thomstark. <br>📅 **Version**: **3.9.9.0.1** and **earlier** versions. If you use this, you are at risk! 🚩

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Power**: Upload arbitrary files. <br>🔓 **Privileges**: Achieve **Remote Code Execution (RCE)**. <br>📊 **Impact**: High Confidentiality, Integrity, and Availability loss. Full server control! 🏴‍☠️

Q5Is exploitation threshold high? (Auth/Config)

🚪 **Threshold**: **LOW**. <br>🔑 **Auth**: No authentication required (`PR:N`). <br>🌐 **Network**: Network accessible (`AV:N`). <br>👀 **UI**: No user interaction needed (`UI:N`). Easy to exploit! ⚡

Q6Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploit**: Yes. <br>🔗 **Reference**: GitHub repo `whattheslime/file-away-exploit` exists. <br>🌍 **Wild Exploitation**: Likely active given the low barrier. Check WordFence intel for active threats. 🕵️‍♂️

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for **File Away** plugin version. <br>📂 **Feature**: Look for the `upload` endpoint in `class.fileaway_management.php` (Line 1094).…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: Update to the **latest version** immediately. <br>📢 **Source**: Check WordPress.org plugin page or vendor site. <br>⏳ **Status**: Published 2025-03-19. Patch likely available now. Don't wait! ⏰

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Disable the plugin immediately. <br>🗑️ **Action**: Delete or deactivate **File Away**. <br>🔒 **Mitigation**: Block upload endpoints via WAF if possible. Remove risk until updated. 🛑

Q10Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. <br>📈 **Priority**: **P0**. <br>💡 **Reason**: Unauthenticated RCE via simple file upload. Fix NOW to prevent breach. Time is ticking! ⏳

Continue exploring

Vulnerability detail Full AI analysis (login) thomstark CWE-434