File Away for WordPress allows an attacker without any authentication to call the upload() function, because the plugin fails to enforce a capability check and does not validate the file type that is being uploaded. The flaw exists in all releases up to and including 3.9.9.0.1 and is a well‑known arbitrary file upload vulnerability (CWE‑434). Uploaded files can be placed in web‑accessible directories, enabling the attacker to place malicious scripts, configuration files or other components that could be executed to gain remote code execution, deface the site, or exfiltrate data.

All WordPress installations that have the File Away plugin installed with a version equal to or lower than 3.9.9.0.1 are affected. Attackers can target any public WordPress site running the plugin without restricting the upload endpoint.

The CVSS score of 9.8 marks this flaw as critical. An EPSS score of 4% indicates that while the exploitation probability is not trivial, it is non‑negligible. The vulnerability is not currently listed in the CISA KEV catalog. The attack path is straightforward: an adversary can hit the upload endpoint of the plugin without any authentication to deliver an arbitrary file. If the server is configured to execute uploads as PHP or other interpretable code, remote code execution is possible.