High · published November 11, 2025
⚡ Talk about a plot twist! The age-restriction WordPress plugin up to version 3.0.2 allows any authenticated user to become an admin with a hardcoded username and password. It's like letting someone borrow your keys without checking their ID! 🔑 Think of it like a restaurant where any customer can waltz into the kitchen and start changing the menu without the chef's approval. This vulnerability lets any authenticated user take over admin responsibilities, dangerously flipping the chef-hat situation on its head! This is absolutely devastating! An authenticated user, like a subscriber, can create an admin account with unlimited control—imagine letting anyone get behind the counter and alter recipes, or worse, serve up dangerous dishes to all. Sensitive information or site integrity could be at serious risk!
Think of it like a restaurant where any customer can waltz into the kitchen and start changing the menu without the chef's approval. This vulnerability lets any authenticated user take over admin responsibilities, dangerously flipping the chef-hat situation on its head! The vulnerability stems from the lack of authorization checks in the `age_restrictionRemoteSupportRequest` function of the plugin, allowing any logged-in user to create an admin account using a hardcoded username and arbitrary password without any restrictions.
This is absolutely devastating! An authenticated user, like a subscriber, can create an admin account with unlimited control—imagine letting anyone get behind the counter and alter recipes, or worse, serve up dangerous dishes to all. Sensitive information or site integrity could be at serious risk! To fix this, immediately update the age-restriction plugin to version 3.0.3 or later. Additionally, consider auditing user roles to ensure no unauthorized changes have been made, and implement robust access controls to prevent this from happening in the future. You've got this, security hero! Follow these steps to lock things down and keep your site safe! 🛡️