CVE-2025-29004

CVEs › CVE-2025-29004

Description

Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress allows Privilege Escalation.This issue affects Premium Age Verification / Restriction for WordPress: from n/a through 3.0.2; Responsive Coming Soon Landing Page / Holding Page for WordPress: from n/a through 3.0.

Overview

State: PUBLISHED
Assigner (CNA): Patchstack
CVSS severity: HIGH
CVSS score: 8.8 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Effective score: 8.8 / 10 HIGH source: CNA overview
CWE(s): CWE-266
Reserved: 2025-03-11
Published: 2026-01-06 21:25 UTC
Last updated: 2026-04-28 18:11 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29004.json
Linked Threat: CVE-2025-29004 — Responsive Coming Soon Landing Page / Holding Page for WordPress <= 3.0 - Authenticated (Susbcriber+) Privilege Escalation

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-01-06 21:15:42 UTC
NVD last modified: 2026-06-17 09:05:01 UTC
NVD CVSS v3.1: 8.8 / 10 HIGH source: audit@patchstack.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 2.8 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0025 (probability of exploitation in next 30 days)
EPSS percentile: 16.91% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD / KEV / EPSS data refreshed 2026-07-27 16:13 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-0963
Assigner: Patchstack
Published: Jan 6, 2026, 8:25:59 PM
Updated: Apr 28, 2026, 4:11:52 PM
EUVD base score (CVSS 3.1): 8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.0800
Vendors: AA-Team
Products: Responsive Coming Soon Landing Page / Holding Page for WordPress (0 ≤3.0)

Premium Age Verification / Restriction for WordPress (n/a ≤3.0.2)

Responsive Coming Soon Landing Page / Holding Page for WordPress (n/a ≤3.0)
Aliases: GHSA-49f7-mmjq-mr5h

ENISA description: Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress allows Privilege Escalation.This issue affects Premium Age Verification / Restriction for WordPress: from n/a through 3.0.2; Responsive Coming Soon Landing Page / Holding Page for WordPress: from n/a through 3.0.

EUVD references (2)

Affected products (2)

Vendor	Product	Versions	Platforms
AA-Team	Premium Age Verification / Restriction for WordPress	`n/a` (affected)	—
AA-Team	Responsive Coming Soon Landing Page / Holding Page for WordPress	`n/a` (affected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

MITRE references (2) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`escalation.this`	no local data	2026-05-18 21:18 UTC
cve	`CVE-2025-29004`	no local data	2026-06-06 13:38 UTC

Remediations (28)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Security Update Guide - Microsoft

web:msrc.microsoft.com

Discover Microsoft's Security Update Guide for detailed information on security vulnerabilities, updates, and guidance to protect your systems effectively.

2026-09-03 01:43 UTC
Mitigate RedSun Zero-Day Without A Patch | Qualys

web:blog.qualys.com

Key Takeaways RedSun is a critical zero-day vulnerability in Microsoft Defender that allows low-privileged users to gain SYSTEM access No patch is currently available, leaving all Defender-enabled Windows systems potentially exposed Qualys VMDR detects affected assets instantly (QID 92382) TruRisk™ Eliminate enables immediate mitigation , removing exploitability without waiting for a fix ...

2026-09-03 01:43 UTC
CVE-2025-29004 | Kodem

web:www.kodemsecurity.com

Is there a fix for CVE-2025-29004 ? No fixed version is listed for CVE-2025-29004 yet. Monitor the advisory for updates and apply mitigations in the interim. Is CVE-2025-29004 exploitable, and should I be worried? Whether CVE-2025-29004 is exploitable in your environment depends on whether the vulnerable code is present and reachable.

2026-09-03 01:43 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-09-03 01:43 UTC
Security Advisories and Bulletins | Microsoft Learn

web:learn.microsoft.com

Learning path Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training Secure software development means integrating security into each phase of your development lifecycle, from requirements analysis to maintenance. Microsoft provides many services that can help you develop more secure code and deploy a more secure application in the cloud. This ...

2026-09-03 01:43 UTC
LIVECVE — Live Cyber Threat Intelligence

web:livecve.com

LIVECVE — Free real-time cybersecurity threat intelligence. Live threat level, breach checker, CVE lookup, AI chatbot, daily alerts.

2026-09-03 01:43 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-03 01:43 UTC
Wordfence remediation: wordpress-flat-countdown

Wordfence

No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

2026-06-06 13:38 UTC
New NGINX 0-Day "nginx-poolslip" Exposes Millions to RCE

web:cyberpress.org

Because nginx-poolslip specifically targets version 1.31.0, the patch was rushed to deployment by admins. Following CVE -2026-42945, organizations that acted diligently may now find themselves re-exposed to a fresh, unpatched threat.

2026-05-22 12:56 UTC
Fixing Log4j 2.25 Vulnerabilities: A 2025 Retrospective Guide

web:markaicode.com

Learn how to fix Log4j 2.25 security issues with step-by-step remediation strategies based on lessons from the past three years of vulnerability management.

2026-05-22 12:56 UTC
NVD - Vulnerabilities

web:nvd.nist.gov

Mitigation of the vulnerabilities in this context typically involves coding changes, but could also include specification changes or even specification deprecations (e.g., removal of affected protocols or functionality in their entirety)."

2026-05-22 12:56 UTC
KB5089899 - Description of the security update for SQL Server 2025 CU4 ...

web:support.microsoft.com

The Excel file also contains detailed fix lists. Download this Excel file now. Note: Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format.

2026-05-22 12:56 UTC
Windows April 2026 update bug, LSASS crash, reboot loop fix - WinCentral

web:thewincentral.com

April 2026 Windows update causes LSASS crashes and reboot loops on domain controllers. Microsoft is working on a fix . - Read in Latest News on WinCentral

2026-05-22 12:56 UTC
Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws

web:www.bleepingcomputer.com

Today is Microsoft's October 2025 Patch Tuesday, which includes security updates for 172 flaws, including six zero-day vulnerabilities. Get patching!

2026-05-22 12:56 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-05-22 12:56 UTC
Concord NH Patch - Facebook

web:www.facebook.com

Concord NH Patch . 44,188 likes · 3,578 talking about this. Hyperlocal news, alerts, discussions and events for Concord, NH

2026-05-22 12:56 UTC
THE FIX (@thefixza) • Instagram photos and videos

web:www.instagram.com

804K Followers, 26 Following, 6,244 Posts - THE FIX (@thefixza) on Instagram: "#DOWHATSRIGHT Shop on Bash.com Tag your OOTD #THEFIXDrip #THEFIXDenimDrip"

2026-05-22 12:56 UTC
Microsoft fixes 167 security flaws in April, second biggest Patch ...

web:www.pcworld.com

PCWorld reports Microsoft released 167 security fixes in April's Patch Tuesday, marking the second-largest security update ever issued by the company. Eight vulnerabilities are classified as ...

2026-05-22 12:56 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-05-22 02:49 UTC
VirusTotal - Home

web:www.virustotal.com

Streamline your investigations with Google Threat Intelligence Agentic and the new Dark Web (DDW) module. Perform hunting and pivoting across forums using natural language or specific modifiers. Bridge threat actor identities and map global operations easy.

2026-05-22 02:49 UTC
Amherst-Pelham administrators raise alarm over school superintendent's ...

web:www.gazettenet.com

GAZETTE FILE PHOTO AMHERST — A dozen administrators in the Amherst and Amherst-Pelham Regional schools are accusing Superintendent E. Xiomara Herman of threats of physical harm, creating a ...

2026-05-22 02:49 UTC
OnlyFans

web:onlyfans.com

OnlyFans is the social platform revolutionizing creator and fan connections. The site is inclusive of artists and content creators from all genres and allows them to monetize their content while developing authentic relationships with their fanbase.

2026-05-22 02:49 UTC
ServiceNow - Now Support

web:hi.service-now.com

The Now Support portal is your launchpad to access self-help, get technical support, and manage your ServiceNow instances. Log in to manage upgrades, follow changes, view knowledge content, and more. Formerly HI portal.

2026-05-22 02:49 UTC
Grammarly: Free AI Writing Assistance

web:www.grammarly.com

Grammarly makes AI writing convenient. Work smarter with personalized AI guidance and text generation on any app or website.

2026-05-22 02:49 UTC
BREAKING: Elon Musk's First Interview Since Jury Rejected Claim Against ...

web:www.youtube.com

Recently named the #1 Innovator on the Forbes Innovators 250 list, Elon Musk sits down with Forbes' Randall Lane for a wide-ranging conversation on the futur...

2026-05-22 02:49 UTC
Google Translate

web:translate.google.com

Google's service, offered free of charge, instantly translates words, phrases, and web pages between English and over 100 other languages.

2026-05-22 02:49 UTC
MitigationPlanningPortal - FEMA

web:hazards.fema.gov

Access the FEMA Mitigation Planning Portal to manage and update your mitigation plans securely.

2026-05-22 02:49 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-29004.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-29004",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T20:56:51.327587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T20:56:59.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Premium Age Verification / Restriction for WordPress",
          "vendor": "AA-Team",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Responsive Coming Soon Landing Page / Holding Page for WordPress",
          "vendor": "AA-Team",
          "versions": [
            {
              "lessThanOrEqual": "3.0",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress allows Privilege Escalation.<p>This issue affects Premium Age Verification / Restriction for WordPress: from n/a through 3.0.2; Responsive Coming Soon Landing Page / Holding Page for WordPress: from n/a through 3.0.</p>"
            }
          ],
          "value": "Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress allows Privilege Escalation.This issue affects Premium Age Verification / Restriction for WordPress: from n/a through 3.0.2; Responsive Coming Soon Landing Page / Holding Page for WordPress: from n/a through 3.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266 Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:11:52.852Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/age-restriction/vulnerability/wordpress-premium-age-verification-restriction-for-wordpress-plugin-3-0-2-privilege-escalation-vulnerability?_s_id=cve"
        },
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/wordpress-flat-countdown/vulnerability/wordpress-responsive-coming-soon-landing-page-holding-page-for-wordpress-3-0-privilege-escalation-vulnerability?_s_id=cve"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Privilege Escalation Vulnerability in AA-Team WordPress plugins",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-29004",
    "datePublished": "2026-01-06T20:25:59.004Z",
    "dateReserved": "2025-03-11T08:10:52.911Z",
    "dateUpdated": "2026-04-28T16:11:52.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}