Skip to content
Threat Feed
Subscribe
critical advisory

CVE-2026-104800: Unauthenticated Remote Code Execution in AGE-GATE WordPress Plugin

An unauthenticated remote code execution vulnerability in AGE-GATE WordPress plugin version 1.0 and earlier allows attackers to inject PHP code via unsanitized POST parameters.

CVE search metadata

CVE search record: CVE-2026-104800. Severity: critical. CVSS: 9.8. KEV: no. Product: AGE-GATE (<= 1.0). Brief: CVE-2026-104800: Unauthenticated Remote Code Execution in AGE-GATE WordPress Plugin. Brief link: https://feed.craftedsignal.io/briefs/2026-10-age-gate-rce/

The AGE-GATE plugin for WordPress (versions 1.0 and earlier) contains a critical Remote Code Execution (RCE) vulnerability identified as CVE-2026-104800. The flaw resides within a standalone admin.php endpoint that lacks standard WordPress security controls, including authentication, capability checks, and nonce verification. Furthermore, the endpoint does not implement the necessary ABSPATH guards, allowing direct execution of the file without loading the WordPress framework.

Attackers can exploit this by submitting specially crafted POST requests containing malicious PHP code within the 'width' or 'height' parameters. This input is processed without sanitization and written directly into a PHP file that is subsequently executed by the server. This vulnerability provides unauthenticated actors with the ability to execute arbitrary code with the permissions of the web server user, leading to potential full system compromise, data exfiltration, or backdooring of the WordPress environment.

Impact

Successful exploitation allows unauthenticated remote code execution, granting attackers the ability to run arbitrary system commands, modify site content, or gain unauthorized access to the underlying server. Given the nature of WordPress deployments, this affects a broad range of websites using the AGE-GATE plugin, potentially leading to widespread site defacement or the deployment of persistent web shells for further malicious activity.

Recommendation

  • Identify and audit all WordPress installations utilizing the AGE-GATE plugin to determine if version 1.0 or earlier is currently deployed.
  • Disable or remove the AGE-GATE plugin immediately until a patched version is available from the vendor.
  • Monitor web server access logs for anomalous POST requests directed at the /wp-content/plugins/age-gate/admin.php endpoint.
  • Deploy WAF rules to inspect POST request bodies for PHP syntax or unexpected special characters in the 'width' and 'height' parameters.

Immediate actions

Inventory all WordPress sites to identify AGE-GATE plugin version.

SOC 24h

Deploy Sigma detection rule to monitor for exploitation attempts.

Detection Engineering 24h

Mitigations

Disable or remove the AGE-GATE plugin until a patch is available.

immediate IT Operations

CVE-2026-104800

Detection coverage 1

Detect CVE-2026-104800 Exploitation - Malicious POST to AGE-GATE Plugin

critical

Detects exploitation attempts against the AGE-GATE plugin where arbitrary PHP code is injected via POST parameters to the standalone admin.php endpoint.

sigma tactics: execution, initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →