Attackers can exploit this by submitting specially crafted POST requests containing malicious PHP code within the 'width' or 'height' parameters. This input is processed without sanitization and written directly into a PHP file that is subsequently executed by the server. This vulnerability provides unauthenticated actors with the ability to execute arbitrary code with the permissions of the web server user, leading to potential full system compromise, data exfiltration, or backdooring of the WordPress environment.

Impact

Successful exploitation allows unauthenticated remote code execution, granting attackers the ability to run arbitrary system commands, modify site content, or gain unauthorized access to the underlying server. Given the nature of WordPress deployments, this affects a broad range of websites using the AGE-GATE plugin, potentially leading to widespread site defacement or the deployment of persistent web shells for further malicious activity.

Recommendation

• Identify and audit all WordPress installations utilizing the AGE-GATE plugin to determine if version 1.0 or earlier is currently deployed.
• Disable or remove the AGE-GATE plugin immediately until a patched version is available from the vendor.
• Monitor web server access logs for anomalous POST requests directed at the /wp-content/plugins/age-gate/admin.php endpoint.
• Deploy WAF rules to inspect POST request bodies for PHP syntax or unexpected special characters in the 'width' and 'height' parameters.