Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Age Gate WordPress Plugin Allows Unauthenticated Code Execution

CVE-2025-2505 · published 1 year ago
Summary

The Age Gate plugin for WordPress, versions 3.5.3 and earlier, is vulnerable to a security flaw that could allow an attacker to execute unauthorized code on your website, potentially stealing sensitive information or taking control of your site. To protect your site, update the Age Gate plugin to the latest version. If you can't update immediately, consider temporarily disabling the plugin until you can update it safely.

Original advisory text
The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attacker...
The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published20 Mar 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-2505 · NVD
Track software like this
Free during beta