关联漏洞
标题：
WordPress plugin File Away 加密问题漏洞
(CVE-2025-2539)
描述：WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin File Away 3.9.9.0.1及之前版本存在加密问题漏洞，该漏洞源于ajax函数缺少能力检查，可能导致未经验证的攻击者读取服务器上的任意文件内容。
描述
Unauthenticated Arbitrary File Read exploit for WordPress File Away Plugin ≤ 3.9.9.0.1
介绍
# CVE-2025-2539 PoC
Unauthenticated Arbitrary File Read exploit for **WordPress File Away Plugin ≤ 3.9.9.0.1**
---
## 📖 Description
This Python script is a proof-of-concept (PoC) exploit for **CVE-2025-2539**, targeting a vulnerability in the **WordPress File Away Plugin ≤ 3.9.9.0.1**.
The vulnerability allows unauthenticated attackers to read arbitrary files from the server via an exposed plugin endpoint without proper authorization checks.
---
## 📌 Usage
### ▶️ Requirements:
- Python 3
- `requests` library
Install required libraries:
```bash
pip install requests
```
---
**Arguments:**
- `--target` / `-t` : Target WordPress site URL (with HTTP/HTTPS)
- `--file` / `-f` : File path you want to read from the target server (e.g. `wp-config.php`)
---
### ▶️ Run the Exploit:
```bash
python3 CVE-2025-2539.py --target http://target.com --file wp-config.php
```
---
## 🔍 Finding Targets
You can use **Fofa** to discover potentially vulnerable targets.
**Fofa Dork:**
```text
body="/wp-content/plugins/file-away/"
```
Search on: [https://fofa.info](https://fofa.info)
---
## 👨💻 Author
**Md Shoriful Islam (RootHarpy)**
---
## 📜 Disclaimer
This tool is created for educational and authorized penetration testing purposes only.
Unauthorized use of this tool against systems without explicit permission is illegal.
文件快照
[4.0K] /data/pocs/3817a89db6410526e1c7aa4c0ad24d49155f1131
├── [2.3K] CVE-2025-2539.py
└── [1.4K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。