This vulnerability (CVE-2025-49403) in the Premium Age Verification / Restriction WordPress plugin arises from improper control of filenames in include or require statements, classified under CWE-98. It enables unauthenticated attackers to download arbitrary files from the server, potentially exposing sensitive information. The affected versions are all versions up to and including 3.0.2. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, no privileges required, and no user interaction needed. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An unauthenticated attacker can exploit this vulnerability to download arbitrary files from the affected server, potentially leading to disclosure of sensitive information. The vulnerability does not impact integrity or availability but has a high confidentiality impact. This could facilitate further attacks if sensitive configuration or credential files are exposed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to sensitive files via web server configuration and monitoring for suspicious requests targeting the plugin. Avoid using affected versions (<=3.0.2) in production environments if possible.