What’s Vulnerable › Vulnerabilities

CVE-2025-7401: Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.php

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-11 · updated 2026-06-17
• Weakness: CWE-798

Description

The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insufficiently protected remote support functionality in remote_tunnel.php in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to read from or write to arbitrary files on the affected site's server which may make the exposure of sensitive information or remote code execution possible.

Affected products

• AA-Team Premium Age Verification / Restriction for WordPress: through 3.0.2

References

• https://codecanyon.net/item/premium-age-verification-restriction-for-wordpress/11300327
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e0906a45-6d9b-48a0-98ae-df7b591a8848?source=cve

Get alerted when CVE-2025-7401 or the next vulnerability affects your stack