CVE-2025-11855: Privilege Escalation in Age Restriction WordPress Plugin

The primary impact of CVE-2025-11855 is the ability for lower-privileged users to gain administrative access to a WordPress site. An attacker with subscriber access could exploit this vulnerability to create a new administrator account, effectively taking complete control of the website. This control encompasses modifying content, installing malicious plugins, accessing sensitive data, and potentially pivoting to other systems on the network. The ease of exploitation, requiring only authenticated access, significantly broadens the potential attack surface.

1. Reserved2025-10-16
2. Published2025-11-11
3. Modified2026-04-02
4. EPSS updated2026-03-23

The immediate mitigation for CVE-2025-11855 is to upgrade the Age Restriction WordPress plugin to a version containing the fix. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting user roles and permissions to minimize the potential impact. Review user accounts for any suspicious additions. Monitor WordPress logs for unusual activity, particularly attempts to create new administrator accounts. While a WAF may not directly prevent this, it can be configured to flag suspicious requests related to user creation.