CVE-2025-7401 is a critical vulnerability in the aa-team Premium Age Verification / Restriction for WordPress plugin caused by the use of hard-coded credentials (CWE-798) in the remote support functionality implemented in remote_tunnel.php. This weakness enables unauthenticated attackers to perform arbitrary file read and write operations on the affected server, potentially leading to sensitive information disclosure or remote code execution. The issue affects all versions up to and including 3.0.2. The vulnerability has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical impact and ease of exploitation over the network without privileges or user interaction. No patch or official fix has been documented in the provided data.

Successful exploitation allows unauthenticated remote attackers to read and write arbitrary files on the web server hosting the vulnerable plugin. This can lead to disclosure of sensitive information and potentially remote code execution, severely compromising the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or remove the Premium Age Verification / Restriction plugin if possible, or restrict access to the remote_tunnel.php file to trusted IP addresses to mitigate unauthorized exploitation.