Age Restriction <= 3.0.2 - サブスクライバー権限昇格

The primary impact of CVE-2025-11855 is the ability for lower-privileged users to gain administrative access to a WordPress site. An attacker with subscriber access could exploit this vulnerability to create a new administrator account, effectively taking complete control of the website. This control encompasses modifying content, installing malicious plugins, accessing sensitive data, and potentially pivoting to other systems on the network. The ease of exploitation, requiring only authenticated access, significantly broadens the potential attack surface.

Websites utilizing the Age Restriction WordPress plugin, particularly those running versions 0 through 3.0.2, are at risk. Shared hosting environments where multiple websites share the same server are particularly vulnerable, as a compromise of one site could potentially lead to access to others. WordPress installations with weak user management practices are also at increased risk.

• wordpress / composer / npm:

wp plugin list | grep age-restriction

• wordpress / composer / npm:

wp plugin update age-restriction

• wordpress / composer / npm:

grep -r 'age_restrictionRemoteSupportRequest' /var/www/html/wp-content/plugins/age-restriction/

• wordpress / composer / npm:

wp plugin status age-restriction

1. 2025-11-11Disclosure

   disclosure

1. 予約済み2025-10-16
2. 公開日2025-11-11
3. 更新日2026-04-02
4. EPSS 更新日2026-03-23

The immediate mitigation for CVE-2025-11855 is to upgrade the Age Restriction WordPress plugin to a version containing the fix. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting user roles and permissions to minimize the potential impact. Review user accounts for any suspicious additions. Monitor WordPress logs for unusual activity, particularly attempts to create new administrator accounts. While a WAF may not directly prevent this, it can be configured to flag suspicious requests related to user creation.