{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/age-gate--1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:age-gate_project:age-gate:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-104800"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AGE-GATE (\u003c= 1.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe AGE-GATE plugin for WordPress (versions 1.0 and earlier) contains a critical Remote Code Execution (RCE) vulnerability identified as CVE-2026-104800. The flaw resides within a standalone admin.php endpoint that lacks standard WordPress security controls, including authentication, capability checks, and nonce verification. Furthermore, the endpoint does not implement the necessary ABSPATH guards, allowing direct execution of the file without loading the WordPress framework.\u003c/p\u003e\n\u003cp\u003eAttackers can exploit this by submitting specially crafted POST requests containing malicious PHP code within the 'width' or 'height' parameters. This input is processed without sanitization and written directly into a PHP file that is subsequently executed by the server. This vulnerability provides unauthenticated actors with the ability to execute arbitrary code with the permissions of the web server user, leading to potential full system compromise, data exfiltration, or backdooring of the WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote code execution, granting attackers the ability to run arbitrary system commands, modify site content, or gain unauthorized access to the underlying server. Given the nature of WordPress deployments, this affects a broad range of websites using the AGE-GATE plugin, potentially leading to widespread site defacement or the deployment of persistent web shells for further malicious activity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and audit all WordPress installations utilizing the AGE-GATE plugin to determine if version 1.0 or earlier is currently deployed.\u003c/li\u003e\n\u003cli\u003eDisable or remove the AGE-GATE plugin immediately until a patched version is available from the vendor.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests directed at the \u003ccode\u003e/wp-content/plugins/age-gate/admin.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eDeploy WAF rules to inspect POST request bodies for PHP syntax or unexpected special characters in the 'width' and 'height' parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T04:35:50Z","date_published":"2026-10-14T04:35:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-age-gate-rce/","summary":"An unauthenticated remote code execution vulnerability in AGE-GATE WordPress plugin version 1.0 and earlier allows attackers to inject PHP code via unsanitized POST parameters.","title":"CVE-2026-104800: Unauthenticated Remote Code Execution in AGE-GATE WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-age-gate-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - AGE-GATE (\u003c= 1.0)","version":"https://jsonfeed.org/version/1.1"}