PT-2025-12016 · WordPress · Age Gate

Michael Mazzolini

·

Published

2025-03-20

·

Updated

2025-09-15

·

CVE-2025-2505

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Age Gate plugin for WordPress versions up to, and including, 3.5.3
Description The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion via the lang parameter. This allows unauthenticated attackers to include and execute arbitrary PHP files on the server, enabling them to bypass access controls, obtain sensitive data, or achieve code execution. Over 40,000 WordPress sites are potentially affected.
Recommendations Update to version 3.5.4 to secure against attacks. As a temporary workaround, consider restricting access to the lang parameter to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-2505

Affected Products

Age Gate