VDB

CVE-2025-2505

CVE-2025-2505 PUBLISHED KEV CVSS 9.800000190734863 CRITICAL

The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

EPSS 4.88% · 92.0th percentile

Risk Scores

CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
4.88%
92.0th percentile

Affected Products

VendorProductVersions
philsburyAge Gate*, 0

Timeline

  • Nov 2, 2022 CrowdSec Sighting
  • Jul 13, 2024 CrowdSec Sighting
  • Aug 15, 2024 CrowdSec Sighting
  • Nov 2, 2024 CrowdSec Sighting
  • Feb 1, 2025 CrowdSec Sighting
  • Mar 19, 2025 VulnCheck KEV Exploitation
  • Mar 20, 2025 EPSS Score
  • Mar 20, 2025 CVE Published
  • Mar 20, 2025 PoC Published
  • Mar 20, 2025 PoC Published
  • Mar 20, 2025 PoC Published
  • Mar 20, 2025 PoC Published

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›