CVE-2025-2505
Published: 20 March 2025
Summary
CVE-2025-2505 is a critical-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Age Gate plugin for WordPress is vulnerable to local PHP file inclusion in all versions through 3.5.3. The flaw, tracked as CWE-22, resides in the handling of the lang parameter within the plugin's Settings.php component and permits an attacker to supply an arbitrary file path that the server will include and execute.
Unauthenticated remote attackers can exploit the issue over the network without any user interaction or credentials. Successful exploitation allows inclusion of attacker-controlled PHP files, which can be used to bypass access controls, read sensitive data, or obtain code execution on the server when combined with the ability to upload files such as images that the web server will interpret as PHP.
Public references point to a WordPress plugin changeset that addresses the vulnerability and to a detailed Wordfence advisory that recommends updating the Age Gate plugin to a fixed release.
EPSS for the CVE rose from a low baseline to a peak of 0.0201 before receding to the current value of 0.0044, indicating a temporary increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6740
Vulnerability details
The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on…
more
the server, allowing the execution of code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an unauthenticated remote file inclusion vulnerability in a public-facing WordPress plugin that enables arbitrary PHP code execution over the network, directly mapping to exploitation of public-facing applications for initial access and code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper handling of the 'lang' parameter by requiring validation of inputs to block path traversal and arbitrary PHP file inclusion.
Requires timely application of the available patch (changeset 3258075) to remediate the LFI vulnerability in the Age Gate plugin's Settings.php.
Boundary protection via web application firewalls can inspect and block malicious 'lang' parameter payloads attempting LFI exploitation over network interfaces.