CVE-2025-2505: Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2505?
CVE-2025-2505 has been classified as a high severity vulnerability due to its potential for allowing unauthenticated remote code execution.
How do I fix CVE-2025-2505?
To fix CVE-2025-2505, update the Age Gate plugin for WordPress to version 3.5.4 or later.
What types of systems are affected by CVE-2025-2505?
CVE-2025-2505 affects all versions of the Age Gate plugin for WordPress up to and including version 3.5.3.
What is the impact of the CVE-2025-2505 vulnerability?
The impact of CVE-2025-2505 includes the ability for attackers to include and execute arbitrary PHP files on the server.
Who can exploit CVE-2025-2505?
CVE-2025-2505 can be exploited by unauthenticated attackers, posing a significant threat to the security of affected WordPress sites.