The Premium Age Verification / Restriction for WordPress plugin exposes a remote support endpoint that is insufficiently protected. An unauthenticated attacker can send crafted requests to remote_tunnel.php and supply arbitrary file paths, allowing them to read or overwrite any file on the server. This vulnerability can expose sensitive data or enable the attacker to execute malicious code on the web host, compromising confidentiality, integrity, and availability. The weakness is identified as CWE‑798, indicating insecure handling of credentials or access control.

Any WordPress site that has installed the Premium Age Verification / Restriction for WordPress plugin by aa-team, for any version up to and including 3.0.2. No specific WordPress core versions are indicated, so the risk applies to all installations that rely on this plugin within the stated version range.

The CVSS score of 9.8 classifies this flaw as critical, while the EPSS score of less than 1% suggests low current exploitation likelihood, yet attackers could still target the flaw whenever the plugin is found online. The vulnerability is not listed in the CISA KEV catalog, but the high severity and scope of the vulnerability warrant immediate remediation. It can be exploited by sending arbitrary HTTP requests to the exposed endpoint without authentication, making the attack vector straightforward for adversaries with basic web mapping tools.