CVE-2025-2505 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Path Traversal & Local File Inclusion (LFI) in 'Age Gate' plugin. 💥 **Consequences**: Attackers can read arbitrary files or execute malicious PHP code on the server. Total server compromise possible! 📉

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-22 (Path Traversal). 🔍 **Flaw**: The `lang` parameter is not sanitized. It allows attackers to inject directory traversal sequences (`../`) to include local PHP files. 📂

Q: Who is affected? (Versions/Components)

👥 **Affected**: WordPress Plugin: **Age Gate**. 📦 **Versions**: **3.5.3 and earlier**. 🏢 **Vendor**: philsbury. If you use this plugin, you are at risk! ⚠️

Q: Is exploitation threshold high? (Auth/Config)

📊 **Threshold**: **LOW**. 🔑 **Auth**: None required (PR:N). 🌐 **Network**: Remote (AV:N). 👀 **UI**: None required (UI:N). ⚡ Easy to exploit for anyone! 🚀

Q: Is there a public Exp? (PoC/Wild Exploitation)

🧨 **Public Exploit**: **No PoC provided** in data. 📝 **Status**: POCs list is empty. However, given the CVSS 9.8 score, wild exploitation is likely imminent. Stay alert! 👀

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1️⃣ Check WP Admin for 'Age Gate' plugin. 2️⃣ Verify version is **≤ 3.5.3**. 3️⃣ Scan for `lang` parameter manipulation in requests. 🕵️♂️

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **YES**. 🔗 **Patch**: Update to version **3.5.4+** (implied by changeset 3258075). 📥 **Action**: Go to WP Dashboard → Plugins → Update NOW! 🏃♂️

Q: What if no patch? (Workaround)

🚧 **No Patch?**: 1️⃣ **Disable** the plugin immediately. 2️⃣ **Delete** it if not needed. 3️⃣ Block `lang` parameter in WAF rules. 🛑 Do not leave it running! 🚫

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL** (CVSS 9.8). ⏰ **Priority**: **IMMEDIATE**. 🚨 This is a high-severity RCE vulnerability. Patch today, not tomorrow! ⏳

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Path Traversal & Local File Inclusion (LFI) in 'Age Gate' plugin. <br>💥 **Consequences**: Attackers can read arbitrary files or execute malicious PHP code on the server. Total server compromise possible! 📉

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-22 (Path Traversal). <br>🔍 **Flaw**: The `lang` parameter is not sanitized. It allows attackers to inject directory traversal sequences (`../`) to include local PHP files. 📂

Q3Who is affected? (Versions/Components)

👥 **Affected**: WordPress Plugin: **Age Gate**. <br>📦 **Versions**: **3.5.3 and earlier**. <br>🏢 **Vendor**: philsbury. If you use this plugin, you are at risk! ⚠️

Q4What can hackers do? (Privileges/Data)

💀 **Hacker Powers**: <br>1️⃣ **Read Data**: Access sensitive server files (configs, keys). <br>2️⃣ **Execute Code**: Run arbitrary PHP code. <br>3️⃣ **Full Control**: Gain RCE (Remote Code Execution).…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

📊 **Threshold**: **LOW**. <br>🔑 **Auth**: None required (PR:N). <br>🌐 **Network**: Remote (AV:N). <br>👀 **UI**: None required (UI:N). <br>⚡ Easy to exploit for anyone! 🚀

Q6Is there a public Exp? (PoC/Wild Exploitation)

🧨 **Public Exploit**: **No PoC provided** in data. <br>📝 **Status**: POCs list is empty. However, given the CVSS 9.8 score, wild exploitation is likely imminent. Stay alert! 👀

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1️⃣ Check WP Admin for 'Age Gate' plugin. <br>2️⃣ Verify version is **≤ 3.5.3**. <br>3️⃣ Scan for `lang` parameter manipulation in requests. 🕵️‍♂️

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **YES**. <br>🔗 **Patch**: Update to version **3.5.4+** (implied by changeset 3258075). <br>📥 **Action**: Go to WP Dashboard → Plugins → Update NOW! 🏃‍♂️

Q9What if no patch? (Workaround)

🚧 **No Patch?**: <br>1️⃣ **Disable** the plugin immediately. <br>2️⃣ **Delete** it if not needed. <br>3️⃣ Block `lang` parameter in WAF rules. <br>🛑 Do not leave it running! 🚫

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL** (CVSS 9.8). <br>⏰ **Priority**: **IMMEDIATE**. <br>🚨 This is a high-severity RCE vulnerability. Patch today, not tomorrow! ⏳

Continue exploring

Vulnerability detail Full AI analysis (login) philsbury CWE-22