Critical · published March 19, 2025
🚨 The File Away plugin for WordPress has a gaping hole that lets anyone upload dangerous files without a hitch! 🔥 Think of it like a hotel that lets anyone walk in and drop off packages without checking if they’re safe — a recipe for disaster! An attacker could upload malicious files that enable remote code execution, potentially compromising your entire server. This is no minor breach; it's an open invitation for chaos and data loss!
Think of it like a hotel that lets anyone walk in and drop off packages without checking if they’re safe — a recipe for disaster! This vulnerability arises from a missing capability check and file type validation in the upload() function, allowing unauthenticated users to upload arbitrary files on the server.
An attacker could upload malicious files that enable remote code execution, potentially compromising your entire server. This is no minor breach; it's an open invitation for chaos and data loss! Immediately update the File Away plugin to version 3.9.9.0.2 or later. Additionally, consider implementing strict file type validations and capability checks to prevent this from happening in the future. You've got this! Secure your WordPress site, and you'll have those invaders locked out in no time! 🛡️