What is the CVSS score of CVE-2025-49403?

CVE-2025-49403 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Premium Age Verification are affected by CVE-2025-49403?

The Premium Age Verification/Restriction WordPress plugin (versions ≤ 3.0.2) contains a critical unauthenticated file disclosure vulnerability enabling remote attackers to retrieve sensitive…

How to fix or mitigate CVE-2025-49403?

24 hours: Scan all WordPress environments (WPScan, Wordfence) to identify Premium Age Verification/Restriction plugin versions ≤ 3.0.2. 7 days: Deactivate and remove the vulnerable plugin from all affected installations; migrate to alternative age verification solutions with current security support. 30 days: Monitor for vendor patch availability; if plugin removal is not immediately feasible, deploy compensating Web Application Firewall rules to block suspicious file access patterns.

Premium Age Verification CVE-2025-49403

EUVD-2025-210217 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP WordPress Information Disclosure LFI Premium Age Verification Restriction For Wordpress

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated HTTP endpoint (AV:N/AC:L/PR:N/UI:N); arbitrary file read yields high confidentiality impact but no integrity or availability impact, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:48 vuln.today

CVE Published

Jun 17, 2026 - 09:50 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions.

AnalysisAI

Unauthenticated arbitrary file download in the Premium Age Verification / Restriction for WordPress plugin (versions ≤ 3.0.2) allows remote attackers to retrieve arbitrary files from the underlying server without any credentials or user interaction. The CVSS 3.1 score of 7.5 reflects high confidentiality impact with no integrity or availability impact, consistent with file disclosure rather than code execution. There is no public exploit identified at time of analysis and the issue is not present in CISA KEV, but Patchstack has confirmed the flaw against a default plugin installation.

Technical ContextAI

The affected component is the AA-Team 'Premium Age Verification / Restriction for WordPress' plugin (CPE cpe:2.3:a:aa-team:premium_age_verification_/_restriction_for_wordpress), a commercial WordPress plugin that gates content behind an age-gate prompt. CWE-98 categorises this class as improper control of a filename used in a PHP include/require statement, which in practice means an attacker-controlled parameter is passed into a file-handling function. The tag set (LFI, Information Disclosure, PHP) and the 'Arbitrary File Download' description together indicate that a request parameter is reflected into a file path that the plugin then opens and streams back to the client, rather than executed as PHP - making this a file disclosure rather than full RFI/LFI-to-RCE primitive. Because the endpoint is reachable pre-authentication, the WordPress role/capability model offers no protection.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack record covers versions ≤ 3.0.2 but the input does not name a fixed release, so administrators should consult the advisory at https://patchstack.com/database/wordpress/plugin/age-restriction/vulnerability/wordpress-premium-age-verification-restriction-for-wordpress-plugin-3-0-2-arbitrary-file-download-vulnerability and upgrade to a vendor-released version newer than 3.0.2 if one has since been published. Until a fix is confirmed, deactivate and remove the plugin (the cleanest mitigation, at the cost of losing the age-gate functionality) or place a WAF/Patchstack mitigation rule in front of WordPress to block requests carrying suspicious file-path parameters to the plugin's endpoints - note this can break legitimate plugin AJAX calls if the rule is too broad. As a defence-in-depth step, rotate any secrets that may have been exposed in wp-config.php (database password, AUTH_KEY/SECURE_AUTH_KEY salts) on any internet-facing site that has run vulnerable versions.