Vulnetix
Try Vulnetix Request Demo
CVE-2025-2505 PUBLISHED CVSS 9.800000190734863 CRITICAL

The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

EPSS 2.01% · 83.6th percentile

Risk Scores

CVSS v3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
2.01%
83.6th percentile

Affected Products

VendorProductVersions
philsburyAge Gate*, 0

Timeline

References

Open in Interactive Console →