EUVD-2025-21108
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insufficiently protected remote support functionality in remote_tunnel.php in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to read from or write to arbitrary files on the affected site's server which may make the exposure of sensitive information or remote code execution possible.
Analysis
The Premium Age Verification / Restriction for WordPress plugin contains an insufficiently protected remote support functionality in remote_tunnel.php that allows unauthenticated attackers to read from or write to arbitrary files on affected servers. This critical vulnerability (CVSS 9.8) affects all versions up to and including 3.0.2, potentially enabling sensitive information disclosure or remote code execution without authentication. Given the critical CVSS score and network-accessible attack vector, this vulnerability should be treated as high priority pending confirmation of KEV status and active exploitation.
Technical Context
The vulnerability exists in the remote_tunnel.php file within the Premium Age Verification / Restriction plugin for WordPress. The root cause is classified under CWE-798 (Use of Hard-Coded Credentials) and relates to insufficiently protected remote support functionality. The plugin appears to implement a remote tunnel or support mechanism intended for administrators, but the access controls are inadequate, allowing unauthenticated network-based attackers to bypass authorization checks. This is a classic case of insecure direct object reference (IDOR) or missing authentication in a file operation handler. The vulnerability affects the WordPress plugin ecosystem, where remote_tunnel.php likely handles file I/O operations (read/write) without proper authentication validation or CSRF protection. Attackers can interact with the plugin's endpoints directly via HTTP requests without needing valid WordPress credentials or user accounts.
Affected Products
Premium Age Verification / Restriction for WordPress (All versions up to and including 3.0.2)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today