Age Restriction <= 3.0.2 - Authenticated (Subscriber+) Privilege Escalation
Strategic Overview
<= 3.0.2CVE-2025-11855Vulnerability Overview
The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the 'age_restrictionRemoteSupportRequest' AJAX action in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary administrative user accounts.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-269 (Improper Privilege Management) The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C