CVE-2026-104800: AGE-GATE WordPress Plugin RCE Vulnerability

CVE-2026-104800 Overview

CVE-2026-104800 is an unauthenticated remote code execution vulnerability in the AGE-GATE plugin for WordPress affecting all versions up to and including 1.0. The flaw resides in the plugin's standalone admin.php endpoint, which does not load WordPress and lacks an ABSPATH guard. Attackers can inject unsanitized POST parameters (width and height) directly into generated PHP source code that is written to an included file. The endpoint is missing authentication, capability checks, and nonce verification. Any unauthenticated attacker with network access to a vulnerable site can achieve code execution on the server.

Critical Impact
Unauthenticated attackers can inject arbitrary PHP into an included file through the admin.php endpoint, resulting in full remote code execution on the WordPress host.

Affected Products

AGE-GATE plugin for WordPress (slug: wp-site-age-gate)
All versions up to and including 1.0
WordPress sites exposing the plugin's standalone admin.php endpoint

Discovery Timeline

2026-10-14 - CVE-2026-104800 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-104800

Vulnerability Analysis

The AGE-GATE plugin ships a standalone admin.php file that handles configuration updates for the age gate interface. Unlike typical WordPress admin screens, this file does not bootstrap the WordPress core. Because WordPress is never loaded, no session, capability, or nonce checks apply, and the file has no ABSPATH guard to prevent direct invocation. The plugin registers decorative capability arguments through a simulated menu API, but these arguments are never enforced at the HTTP layer.

When admin.php processes a POST request, it takes attacker-controlled values from the width and height parameters and concatenates them into PHP source code. That source is then written to a file that the plugin later includes during normal page rendering. The classification maps to [CWE-434] Unrestricted Upload of File with Dangerous Type, because the resulting file is executable PHP sourced from untrusted input.

Root Cause

The root cause is two-fold. First, admin.php is a non-WordPress entry point with no authentication, capability, or nonce verification. Second, the handler trusts raw POST parameters and inlines them into generated PHP written to disk. The combination converts a configuration form into an unauthenticated code-writing primitive.

Attack Vector

Exploitation requires only network access to the vulnerable WordPress site. An attacker sends a crafted POST request to the plugin's admin.php with malicious payloads in the width or height fields. The handler writes the attacker's payload into the included PHP file. The next request that triggers the include evaluates the injected code under the web server user. Review the Wordfence Vulnerability Report and the WordPress Plugin Admin File for the specific code paths.

No verified public exploit code is available at the time of writing. See the referenced source files, including the agegate.php include logic and the main.php generation routines, for the vulnerable sinks.

Detection Methods for CVE-2026-104800

Indicators of Compromise

Unexpected POST requests to /wp-content/plugins/wp-site-age-gate/admin.php from external IP addresses without prior authenticated session cookies.
Modified or newly created PHP files under the wp-site-age-gate plugin directory containing non-numeric values in width or height assignments.
Outbound network connections or shell commands originating from the PHP-FPM or Apache worker process after requests to the plugin endpoint.
Web shell artifacts, scheduled tasks, or new administrator accounts created shortly after suspicious admin.php traffic.

Detection Strategies

Inspect web server access logs for POST requests targeting wp-site-age-gate/admin.php and alert on any such requests from untrusted sources.
Enable file integrity monitoring on the plugin directory to detect unauthorized writes to generated PHP files.
Deploy WAF rules that block POST bodies containing PHP tags, backticks, or system, exec, passthru, and eval tokens targeting the plugin path.

Monitoring Recommendations

Monitor PHP process trees for shells (sh, bash, cmd.exe) spawned by the web server user.
Alert on changes to WordPress administrator accounts, options tables, and plugin files following requests to the vulnerable endpoint.
Correlate web request telemetry with endpoint process execution to identify post-exploitation activity.

How to Mitigate CVE-2026-104800

Immediate Actions Required

Deactivate and remove the AGE-GATE plugin from all WordPress installations until a patched release is confirmed.
Block direct HTTP access to wp-content/plugins/wp-site-age-gate/admin.php at the web server or WAF layer.
Audit the plugin directory and WordPress installation for modified files, injected PHP, and unauthorized accounts.
Rotate all WordPress administrator credentials, API keys, and secrets stored in wp-config.php if compromise is suspected.

Patch Information

At the time of publication, no fixed version is listed in the available advisory data. The vulnerability affects all versions up to and including 1.0. Monitor the Wordfence Vulnerability Report and the plugin's source repository for a patched release.

Workarounds

Remove or rename the plugin directory to break the unauthenticated entry point until a fix is available.
Add a web server rule denying all requests to admin.php within the plugin path.
Enforce authentication at the reverse proxy for any /wp-content/plugins/ requests that accept POST data.

bash

# Nginx: block direct access to the vulnerable endpoint
location ~* /wp-content/plugins/wp-site-age-gate/admin\.php$ {
    deny all;
    return 403;
}

# Apache (.htaccess) equivalent
<Files "admin.php">
    Require all denied
</Files>