CVE-2026-104800

Deferred Deferred - Pending Action

Remote Code Execution in AGE-GATE WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104800

EUVD

EUVD-2026-100785

Affected Vendors & Products

Vendor	Product	Version / Range
streetforce1	AGE-GATE	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

The AGE-GATE WordPress plugin has a Remote Code Execution vulnerability in versions up to 1.0. The issue is in the 'width' and 'height' parameters of the standalone admin.php endpoint. Due to missing authentication, capability checks, and nonce verification, attackers can inject unsanitized POST parameters directly into PHP source code, which is then written to a file. This allows unauthenticated attackers to execute arbitrary code on the server.

Detection Guidance

Check for unauthorized files in the AGE-GATE plugin directory, particularly files modified or created recently. Look for suspicious admin.php access attempts in server logs. Verify if POST requests to admin.php contain unusual parameters like width or height with code injection attempts.

Impact Analysis

This vulnerability allows attackers to take full control of your WordPress server. They can execute any code, steal data, install malware, or use your server for further attacks. Since it requires no authentication, any visitor to your site could exploit it.

Compliance Impact

This vulnerability could lead to severe compliance violations. If attackers gain access, they may exfiltrate sensitive data (e.g., personal or health information), violating GDPR or HIPAA. Unauthorized code execution also breaches security requirements in these regulations.

Mitigation Strategies

Immediately disable or remove the AGE-GATE WordPress plugin from all installations. Ensure WordPress core files and other plugins are updated to the latest versions. Monitor server logs for suspicious activity, particularly unauthorized file writes or code execution attempts.

Hi! I’m here to help you understand CVE-2026-104800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70