Description
File Away是一个易于使用且超级可定制的前端表单。File Away <= 3.9.9.0.1版本存在任意文件读取漏洞，攻击者获取系统敏感文件。
Wordpress 插件 File Away /wp-admin/admin-ajax.php 文件读取漏洞（CVE-2025-2539）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/file-away/file-away-39901-missing-authorization-to-unauthenticated-arbitrary-file-read
https://nvd.nist.gov/vuln/detail/CVE-2025-2539
https://github.com/whattheslime/file-away-exploit
https://www.sentinelone.com/vulnerability-database/cve-2025-2539/
https://hackhalt.com/threat/cve-2025-2539/
https://medium.com/@richiefallaria612/how-i-found-a-file-away-vunerability-on-a-website-37fca11ea240
https://www.verylazytech.com/vulnerabilities-and-exploits/cve-poc/poc-cve-2025-2539-file-away-less-than-3.9.9.0.1-missing-authorization-to-unauthenticated-arbitrary-f
https://cve.imfht.com/detail/CVE-2025-2539?lang=en