Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-104800: AGE-GATE plugin allows anyone to run code on server
CVE-2026-104800 · published 20 days ago
Summary
The Age‑Gate plugin for WordPress (versions up to 1.0) lets anyone send specially crafted requests that cause the site to execute whatever code they include. This means a stranger could take control of your web server without logging in. Update the plugin to a fixed version, or remove/disable it until a patch is applied, and ensure only trusted users can access the admin.php file.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| streetforce1 | age-gate | <= 1.0 |
Original advisory text
AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.
References
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L279
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L325
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L213
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L291
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/admin.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/05db28b4-a3de-402d-bc5...
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/nonwp.php#L20
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/agegate.php#L1...
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-434Unrestricted File Upload
Timeline
Published14 Oct 2026
Updated31 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta