This vulnerability, identified as CWE-98, involves improper control of filenames used in include or require statements within the Premium Age Verification / Restriction WordPress plugin by AA-Team. Specifically, versions up to 3.0.2 are affected by an unauthenticated arbitrary file download issue, allowing attackers to retrieve arbitrary files from the server. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No official patch or remediation level has been published as of the data provided.

Successful exploitation allows unauthenticated attackers to download arbitrary files from the affected server, potentially exposing sensitive information. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been published, users should monitor the vendor's communications for updates. Until a patch is available, consider restricting access to the plugin files and limiting exposure of the affected WordPress installation to untrusted networks.