CVE-2025-29004CWE-266

CVE-2025-29004

High · published January 7, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

⚡ An incorrect privilege assignment could turn your trusted admin into a mere onlooker! This vulnerability in AA-Team's Premium Age Verification plugin is a privilege escalation waiting to happen! 😱 Think of it like a restaurant where the head chef accidentally hands the keys to the pantry to a customer. Suddenly, that customer could access top-secret recipes and ingredients, causing chaos in the kitchen! 🍽️ If exploited, an attacker could elevate their privileges, allowing them to access restricted content or settings. This could lead to unauthorized changes, data exposure, and ultimately, a compromised website—absolutely devastating for your operations.

Put simply

Think of it like a restaurant where the head chef accidentally hands the keys to the pantry to a customer. Suddenly, that customer could access top-secret recipes and ingredients, causing chaos in the kitchen! 🍽️ This vulnerability in the AA-Team Premium Age Verification and Responsive Coming Soon plugins allows users to escalate their privileges due to incorrect assignment, meaning they can perform actions beyond their intended permissions.

What to do

If exploited, an attacker could elevate their privileges, allowing them to access restricted content or settings. This could lead to unauthorized changes, data exposure, and ultimately, a compromised website—absolutely devastating for your operations. To safeguard your site, immediately update the Premium Age Verification / Restriction plugin to version 3.0.3 and the Responsive Coming Soon Landing Page plugin to version 3.1. Ensure you audit user permissions to limit unauthorized access. 🛡️ You've got this! By following these steps, you'll reinforce your defenses and keep your site secure! 💪✨

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00302 · 21.7th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-01-07T02:15Z
References (2)
EPSS history
Timeline
  • 06 JAN 20:25Z
    Privilege Escalation Vulnerability in AA-Team WordPress plugins
    cvelistv5