/Vulnerability Library

WordPress Age Gate <= 3.5.3 - Unauthenticated Local File Inclusion

CVE-2025-2505
Verified

Description

The Age Gate plugin for WordPress up to version 3.5.3 contains a local PHP file inclusion caused by the 'lang' parameter, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication.

Severity

Critical

CVSS Score

9.8

Exploit Probability

5%

Published Date

May 7, 2026

Template Author

pussycat0x

CVE-2025-2505.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-2505
CWE ID:
cwe-98

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/age-gate/age-gate-353-unauthenticated-local-php-file-inclusion-via-langhttps://plugins.trac.wordpress.org/changeset/3271222/age-gate

Remediation Steps

Update to the latest version of the plugin, version 3.5.4 or later.