Vulnerability Overview: CVE-2025-2505
Description
The Age Gate plugin for WordPress has been identified as vulnerable to Local PHP File Inclusion (LFI) in all versions up to and including 3.5.3. This vulnerability arises through exploitation of the ‘Lang’ parameter, which allows unauthenticated attackers to include and execute arbitrary PHP files on the server. By successfully executing this vulnerability, attackers may bypass access controls, access sensitive information, or execute code using files that would typically be considered "safe," such as images.
This kind of vulnerability can have severe implications, as it opens the door for attackers to manipulate server behavior, execute unauthorized scripts, and ultimately compromise the integrity and confidentiality of the affected system.
Technical Metrics
The Common Vulnerability Scoring System (CVSS) metrics provide a standardized way to assess the severity of this vulnerability. The vulnerability has a CVSS version 3.1 score of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating it is highly critical. This score reflects the following:
- Access Vector (AV): Network (N)
- Access Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
Given these metrics, the vulnerability is classified as highly severe, emphasizing the urgency for mitigation.
Weakness Enumeration
The vulnerability is associated with the following weakness in the Common Weakness Enumeration (CWE) framework:
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
This classification further elucidates the nature of the vulnerability, highlighting the improper handling of file path inputs.
Historical Context
The CVE record CVE-2025-2505 was officially created and received from WordFence on March 20, 2025. Initial descriptions and details about the vulnerability were documented at this time, making it essential for website administrators and developers to take prompt action.
References and Additional Information
Several references have been provided to facilitate further investigation into this vulnerability, including:
- Links to the Age Gate plugin code repository where the vulnerability can be directly observed (e.g., Age Gate Settings).
- Additional historical changes made to the plugin that can help in understanding how the vulnerability has persisted over versions (e.g., WordPress Changeset).
- A comprehensive threat intelligence report from Wordfence providing details of the attack vector and potential impacts (e.g., Wordfence Threat Intel).
Conclusion
In summary, CVE-2025-2505 highlights a significant security flaw in the Age Gate plugin affecting all versions up to 3.5.3, enabling unauthorized file execution on WordPress servers. The implications of this vulnerability necessitate immediate attention from users of the affected plugin to ensure web applications are secured against potential exploitation by malicious actors.