CVE-2025-11855: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2025-11855 affects the age-restriction WordPress plugin through version 3.0.2. The vulnerability was discovered by Khaled Alenazi and publicly disclosed on October 21, 2025. The issue exists in the age_restrictionRemoteSupportRequest function, which lacks proper authorization controls (WPScan).

The vulnerability stems from missing authorization checks in the age_restrictionRemoteSupportRequest function. This security flaw allows any authenticated user, including those with subscriber-level privileges, to create an administrative user account with a hardcoded username and arbitrary password. The CVSS score for this vulnerability is 7.5 (high), and it is classified as a privilege escalation vulnerability under CWE-269 (WPScan).

The vulnerability allows authenticated users with minimal privileges (subscriber level) to escalate their privileges to administrative access. This can lead to complete compromise of the WordPress installation, as the attacker can create an admin user with the hardcoded username 'aateam_support' and a password of their choosing (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the age-restriction plugin should consider disabling the plugin until a security update is released (WPScan).