AGE-GATE Plugin 1.0 Critical: Unauthenticated RCE via Unsanitized POST in admin.php

The AGE-GATE plugin for WordPress allows unauthenticated attackers to execute arbitrary code on the server through a critical remote code execution flaw, according to the National Vulnerability Database. This issue affects all published versions of the plugin up to and including version 1.0, created by streetforce1. The vulnerability is tracked as CVE-2026-104800 and is classified with a CVSS score of 9.8, indicating a critical risk level for any site running this software.

Root cause

The core issue stems from the plugin’s standalone admin.php endpoint, which fails to load the standard WordPress environment or implement an ABSPATH guard. According to the NVD record, this design choice removes essential authentication, capability checks, and nonce verification. Consequently, the endpoint operates as a fully unauthenticated entry point. It ignores the decorative capability arguments registered via the plugin’s simulated menu API, leaving the file accessible to anyone who knows its location.

Attack path

An attacker targets the vulnerable endpoint by sending POST requests containing the 'width' and 'height' parameters. The plugin processes these inputs without sanitisation and injects them directly into generated PHP source code. This code is then written to an included file on the server. As the NVD description notes, this mechanism allows an unauthenticated adversary to execute arbitrary commands on the host system, bypassing all standard access controls.

Affected versions

• All versions of the streetforce1 AGE-GATE plugin up to and including 1.0 are affected by CVE-2026-104800.
• No patched version has been confirmed or released by the vendor at the time of this reporting.
• The flaw is present in the plugin’s architecture rather than a specific configuration error, affecting all installations.

Mitigation

• Remove the AGE-GATE plugin immediately if it is not actively required for site functionality.
• Monitor server logs for unusual activity originating from the admin.php endpoint associated with this plugin.
• Implement web application firewalls to block suspicious POST requests targeting known vulnerable parameters.
• Await an official update from the vendor, though no fix has been confirmed yet.

Why it matters

Security teams must understand that unauthenticated remote code execution represents the highest risk tier in web application vulnerabilities. Unlike flaws requiring login credentials, this type of bug allows any internet user to interact with the server. The absence of standard framework guards means the application cannot verify user intent or permissions. Operations teams usually prioritise such issues above all others because they provide attackers with full control over the host system. Checking for standalone endpoints that bypass core authentication is a standard defensive practice.

Background: National Vulnerability Database

The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.

Read the full guide: National Vulnerability Database: Small Business Action Plan

What to do and how to stay safe: WordPress

• Audit your WordPress installations to identify any sites running the AGE-GATE plugin.
• Review server access logs for requests to the admin.php file associated with this plugin.
• Ensure your web application firewall is configured to detect and block anomalous POST data.
• Prepare a plan to remove or replace the plugin once the vendor provides an update.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-104800?

The National Vulnerability Database assigns a CVSS score of 9.8 to this vulnerability, rating it as critical.

Which versions of the AGE-GATE plugin are affected?

All versions up to and including 1.0 are vulnerable to this remote code execution flaw.

Is there a patch available for this vulnerability?

No fix has been confirmed yet; users should monitor vendor announcements for an official update.