CVE-2025-2512 is a critical vulnerability in the File Away WordPress plugin caused by the absence of capability checks and file type validation in the upload() function. This flaw permits unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability affects all versions up to and including 3.9.9.0.1. The CVSS 3.1 base score is 9.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official fix has been documented, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected WordPress site, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe, potentially allowing full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the File Away plugin or restricting file upload capabilities through other means. Monitoring for suspicious file uploads and applying strict web server permissions may reduce risk but do not fully mitigate the vulnerability.