The vulnerability resides in the WordPress Age Restriction plugin version 3.0.2 and earlier. The function age_restrictionRemoteSupportRequest lacks proper authorization checks, permitting any authenticated user—including subscribers—to invoke it. By calling this endpoint the user can create a new administrator account with a hardcoded username and a password chosen at the time of creation. This allows a low‑privileged authenticated user to obtain full administrative rights over the WordPress installation, compromising confidentiality, integrity, and availability of the site.

The affected system is the WordPress Age Restriction plugin, versions up to and including 3.0.2. Users running this plugin on any WordPress environment—regardless of hosting provider or host platform—are at risk. No vendor name was provided, so the plugin is identified by its public name, Age Restriction.

The CVSS score of 7.5 indicates a high‑severity vulnerability that allows remote privileged escalation. The EPSS score is below 1 %, suggesting that active exploitation is unlikely at present and it is not listed in the CISA KEV catalog. However, the attack requires only authenticated access; anyone with subscriber privileges can exploit it by triggering the vulnerable function. Because the abuse creates an administrator account, the impact is total control over the WordPress installation. Attackers could use existing login credentials to execute the exploit, making it a straightforward privilege escalation and thus a notable risk for sites with many subscriber users.