CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
File Away versions up to 3.9.9.0.1 use weak cryptographic algorithms that allow attackers to decrypt sensitive data. An attacker with network access can read encrypted information without authentication. This affects any site using the vulnerable version to store or transmit encrypted files or credentials.
What an attacker can do
Read encrypted data stored or transmitted by the application without needing a password or account.
Potential impact on your site
Sensitive files, credentials, or data encrypted by File Away can be decrypted and read by attackers.
Conditions required to exploit
Network access to the application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
