The Age Gate plugin for WordPress contains a flaw that allows an unauthenticated attacker to include and execute arbitrary PHP files through the 'lang' parameter. This vulnerability falls under CWE‑22 and can be used to bypass access controls, exfiltrate sensitive data, or to achieve code execution when the attacker can place files such as images in upload directories that are later included.

WordPress sites running the philsbury Age Gate plugin, versions up to and including 3.5.3 are affected. Any installation of these vulnerable plugin versions is at risk.

The CVSS score of 9.8 indicates a severe potential impact if exploited, but the EPSS score of < 1% suggests a very low probability of exploitation in the wild. This does not eliminate the risk, as the flaw can still be leveraged by attackers who manage to place a PHP file into a directory that the plugin includes via the 'lang' parameter. The public references show that an attacker can construct an HTTP request referencing a local PHP file, for example by uploading a file disguised as an image and later causing the plugin to include it.