CVE-2026-104800: Unauthenticated RCE in AGE-GATE WordPress Plugin

Overview

A critical, unauthenticated Remote Code Execution (RCE) vulnerability has been disclosed in AGE-GATE, a WordPress age-verification plugin developed by vendor streetforce1. Tracked as CVE-2026-104800 and rated CVSS 9.8 (Critical), the flaw allows a remote, unauthenticated attacker to execute arbitrary PHP code on the underlying server by sending crafted requests to the plugin's standalone admin.php endpoint.

The vulnerability affects all published versions of AGE-GATE up to and including 1.0. As of this writing no patched release has been confirmed, and the plugin should be treated as unsafe to run in production until the vendor ships a fix or the WordPress.org plugin team closes the listing.

Technical Details

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Publicly tracked references classify this issue under CWE-434 (Unrestricted Upload of File with Dangerous Type), with the root cause also matching CWE-306 (Missing Authentication for Critical Function).

How It Works

AGE-GATE ships a standalone admin.php file that is reachable directly, separate from the normal WordPress admin bootstrap (wp-admin/admin.php). Because this file never loads WordPress core, it carries no ABSPATH guard, no session check, and none of the capability (current_user_can) or nonce (wp_verify_nonce) checks that would normally gate a privileged action. The plugin registers a settings page through WordPress's menu API with capability arguments attached, but those arguments are purely decorative — a request sent straight to the standalone file never passes through wp-admin, so they are never evaluated.

The endpoint accepts width and height POST parameters that are intended to configure dimension/styling values for the age-gate overlay. Rather than validating these as numeric input, the handler appears to write the attacker-controlled values directly into generated PHP source that is saved to a file and included later by the plugin — a reasonable technical inference from the disclosed root cause, since no sanitization or escaping is applied before that write. Because the values can break out of the intended numeric context, an attacker can inject arbitrary PHP that executes the next time the generated file is included.

Combined, these two defects mean:

• Anyone with network access to the site can call admin.php directly — no login, no nonce, no capability check.
• Anything submitted as width or height is trusted enough to end up as executable PHP.

That combination is sufficient for full unauthenticated RCE in a single HTTP request.

Impact Assessment

Who Is At Risk

• Any WordPress site with the AGE-GATE plugin installed and active, on any version up to and including 1.0
• Sites where the plugin is merely present but deactivated, since admin.php does not check whether the plugin is active before executing
• Managed WordPress hosts and multi-tenant platforms where AGE-GATE is bundled as part of a theme package or compliance toolkit

Potential Attack Chains

1. Discovery — Attacker fingerprints the site as running AGE-GATE (plugin enumeration, readme.txt, or static asset paths) and locates the plugin's admin.php
2. Unauthenticated Code Injection — Attacker sends a crafted POST request with malicious width/height values directly to admin.php, bypassing authentication, capability checks, and nonce verification entirely
3. Code Execution — The plugin writes the attacker's payload into a PHP file that is subsequently included, executing the attacker's code in the context of the web server user
4. Full Compromise — From arbitrary PHP execution, the attacker can plant a webshell, pivot to the WordPress database (credentials stored in wp-config.php), create rogue administrator accounts, or use the compromised host as a foothold into the broader network

Mitigation

Immediate Actions

• Remove the AGE-GATE plugin immediately. Deactivation alone may not be sufficient, since admin.php can remain reachable independent of plugin activation state — full removal of the plugin directory is the safer action
• Check the WordPress.org plugin page for an updated release before reinstalling; if no patched version exists, do not reinstall
• Audit for signs of compromise on any internet-facing site that has run this plugin: look for unexpected files in the plugin directory, unfamiliar administrator accounts, and unexpected PHP files under wp-content/uploads
• Rotate credentials (WordPress admin passwords, database credentials, API keys stored in wp-config.php) if compromise is suspected

Detection Opportunities

• Web server access logs showing POST requests to any */age-gate/admin.php-style path from unfamiliar source IPs
• Unexpected or recently modified PHP files inside the plugin's directory
• Outbound connections or anomalous process behavior originating from the web server process shortly after such requests
• File integrity monitoring alerts on wp-content/plugins/age-gate/

Defence-in-Depth

• Run a Web Application Firewall (WAF) capable of blocking direct requests to plugin-level admin.php files that bypass the WordPress bootstrap
• Enforce least privilege on the web server process account and isolate it from other tenants/sites on shared hosting
• Maintain an inventory of installed plugins and subscribe to a vulnerability feed (Wordfence, Patchstack, or similar) so unmaintained or newly-disclosed-vulnerable plugins are flagged quickly
• Disable PHP execution in writable upload/cache directories where generated files are stored, via web server configuration, to blunt this class of write-then-include RCE

Background

Unauthenticated RCE vulnerabilities in WordPress plugins follow a recurring pattern, and this one fits it closely: a standalone admin endpoint that completely bypasses the WordPress bootstrap, paired with unsanitized user input that ends up embedded inside generated, executable code. This "write-then-include" class of bug is especially dangerous because it requires no authentication and no complex exploitation chain — a single crafted HTTP request is sufficient to achieve code execution.

Given the plugin's apparent low install base and advisory status reported as "Deferred" by at least one tracking source, organizations should not expect a timely vendor patch. Treat identification of AGE-GATE on any site as an immediate removal action rather than a wait-for-patch situation.

References

• NVD — CVE-2026-104800
• AGE-GATE plugin — WordPress.org
• Wordfence Threat Intelligence