How to: CVE-2025-2539 (2025-03-20)
```
The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm,  to read the contents of arbitrary files on the server, which can contain sensitive information.
```
- [verylazytech/CVE-2025-2539](https://github.com/verylazytech/CVE-2025-2539)
- [RootHarpy/CVE-2025-2539](https://github.com/RootHarpy/CVE-2025-2539)
- [Yucaerin/CVE-2025-2539](https://github.com/Yucaerin/CVE-2025-2539)
- [d4rkh0rse/CVE-2025-2539](https://github.com/d4rkh0rse/CVE-2025-2539)
- [fazaroot/CVE-2025-2539---File-Away-WordPress-Plugin-Arbitrary-File-Read](https://github.com/fazaroot/CVE-2025-2539---File-Away-WordPress-Plugin-Arbitrary-File-Read)