VDB

CVE-2025-2505

CVE-2025-2505 PUBLISHED CVSS 9.800000190734863 CRITICAL

The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

EPSS 0.44% · 63.6th percentile

Risk Scores

CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.44%
63.6th percentile

Affected Products

VendorProductVersions
philsburyAge Gate*, 0

Timeline

  • Mar 19, 2025 VulnCheck KEV Exploitation
  • Mar 20, 2025 EPSS Score
  • Mar 20, 2025 CVE Published
  • Mar 20, 2025 PoC Published
  • Mar 20, 2025 PoC Published
  • Mar 20, 2025 PoC Published
  • Mar 20, 2025 PoC Published
  • Mar 20, 2025 PoC Published
  • Mar 21, 2025 PoC Published
  • Mar 27, 2025 PoC Published
  • Apr 2, 2025 EPSS Score
  • Apr 16, 2025 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›