CVE-2025-49403: WordPress Age Verification File Download Flaw

CVE-2025-49403 Overview

CVE-2025-49403 is an unauthenticated arbitrary file download vulnerability affecting the Premium Age Verification / Restriction for WordPress plugin in versions up to and including 3.0.2. The flaw is categorized under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program), commonly associated with file inclusion weaknesses. Remote attackers can retrieve arbitrary files from the WordPress server without authentication or user interaction. Exposed files may include WordPress configuration data, credentials, and other sensitive content stored on the host.

Critical Impact
Unauthenticated attackers can download arbitrary files from vulnerable WordPress installations over the network, exposing credentials, configuration files, and other sensitive data.

Affected Products

Premium Age Verification / Restriction for WordPress plugin, versions <= 3.0.2
WordPress sites running the age-restriction plugin
All hosting environments where the vulnerable plugin is installed and active

Discovery Timeline

2026-06-17 - CVE-2025-49403 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49403

Vulnerability Analysis

The vulnerability resides in the Premium Age Verification / Restriction plugin's handling of file path parameters. The plugin accepts user-supplied input that is passed to a PHP include or file read operation without proper validation or sanitization. Because the affected endpoint does not enforce authentication, any remote unauthenticated client can interact with it.

Attackers exploit the flaw by issuing HTTP requests that supply a file path or filename parameter pointing to sensitive server resources. The plugin then reads and returns the contents of the targeted file in the response. Sensitive targets include wp-config.php, which contains database credentials and authentication keys, as well as logs and backup files.

The CWE-98 classification indicates that the underlying weakness is improper control of a filename used in a PHP include or file access function. This category of issue typically allows path traversal sequences or absolute paths to bypass intended directory restrictions. The vulnerability affects confidentiality only; it does not enable direct modification of files or denial of service on the host.

Root Cause

The root cause is missing validation on a file path parameter consumed by the plugin's download or include logic. The code does not restrict the requested path to an allowlisted directory, does not strip traversal sequences, and does not require an authenticated session. The combination of these gaps converts a routine file handler into an arbitrary file read primitive.

Attack Vector

Exploitation occurs over the network against the WordPress HTTP interface. The attacker sends a crafted request to the vulnerable plugin endpoint, supplying a parameter that references the target file. No credentials, tokens, or user interaction are required. The server returns the file contents in the HTTP response, completing the data exfiltration in a single round trip.

Refer to the Patchstack WordPress Vulnerability Report for the technical advisory.

Detection Methods for CVE-2025-49403

Indicators of Compromise

HTTP requests to plugin endpoints under /wp-content/plugins/age-restriction/ containing file path parameters or traversal sequences such as ../.
Outbound HTTP responses from the WordPress host containing strings characteristic of wp-config.php, including DB_PASSWORD, AUTH_KEY, or SECURE_AUTH_KEY.
Access log entries showing unauthenticated requests with query parameters referencing absolute paths or system files.

Detection Strategies

Inspect web server access logs for unauthenticated requests targeting the age-restriction plugin paths with suspicious file or path query parameters.
Deploy web application firewall rules that flag path traversal patterns and absolute path references in requests to WordPress plugin endpoints.
Correlate plugin requests with response sizes and content types that deviate from expected plugin behavior, such as large text responses from a download handler.

Monitoring Recommendations

Enable verbose HTTP request logging for the wp-content/plugins/age-restriction/ directory and forward logs to a centralized analytics platform.
Monitor for file system reads of wp-config.php and other sensitive files initiated by the web server user account.
Track plugin inventory across WordPress installations and alert when version 3.0.2 or earlier of Premium Age Verification / Restriction is detected.

How to Mitigate CVE-2025-49403

Immediate Actions Required

Identify all WordPress sites running Premium Age Verification / Restriction at version 3.0.2 or earlier and prioritize them for remediation.
Update the plugin to a patched release as published by the vendor through the WordPress plugin repository.
Rotate all secrets stored in wp-config.php, including database credentials and WordPress authentication unique keys and salts.
Review web server access logs for prior exploitation attempts and investigate any successful arbitrary file reads.

Patch Information

Consult the Patchstack WordPress Vulnerability Report for the fixed version and patch details. Apply the plugin update through the WordPress admin dashboard or via WP-CLI as soon as it is available in your environment.

Workarounds

Deactivate and remove the Premium Age Verification / Restriction plugin until a patched version is installed.
Add web application firewall rules that block requests to the plugin endpoint containing path traversal sequences or references to sensitive filenames such as wp-config.php.
Restrict file system permissions on the WordPress host so that the web server user cannot read sensitive files outside the document root where feasible.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate age-restriction
wp plugin delete age-restriction