AGE-GATE WordPress plugin: Unauthenticated remote code execution via admin.php
Summary
The AGE-GATE WordPress plugin up to and including version 1.0 exposes a standalone admin.php endpoint that does not load WordPress and performs no authentication, capability or nonce checks. Unsanitised POST parameters (width and height) are injected into generated PHP source that is written to an included file. An unauthenticated remote attacker can therefore execute code on the web server, which the CVSS 9.8 rating reflects. Sites without this plugin, or where it is not reachable from the internet, are not exposed in this way.
Affected
- AGE-GATE (streetforce1) WordPress plugin, all versions up to and including 1.0
- Disclosure lists the default status as unaffected; the vendor range <=1.0 is used until the vendor clarifies
Fixed in
Unknown. No patched version or vendor advisory was found at the time of writing.
Workaround
- No vendor workaround found.
- Containment only: block direct web access to the plugin's admin.php at the web server or WAF.
Exploitation
- Unauthenticated exploitation is possible over the network; CISA SSVC lists automatable: yes and technical impact: total.
- No public proof-of-concept was found in the research.
- CISA KEV status not confirmed; check the KEV catalogue directly.
Our recommendation
- Identify all WordPress sites with AGE-GATE installed.
- Deactivate and remove the plugin; this is the only clear mitigation while no fix exists.
- If removal is delayed, block access to admin.php at the web server or WAF.
- Check for AGE-GATE files, including admin.php and generated PHP files, and review them for unexpected code.
- If the plugin was exposed, review admin accounts, scheduled tasks and file integrity, and rotate credentials.
- Re-check the NVD, Wordfence and CISA KEV for a fixed version or exploitation updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence entry www.wordfence.com
- Plugin admin.php (WordPress Trac) plugins.trac.wordpress.org
- Plugin main.php (WordPress Trac) plugins.trac.wordpress.org
- VULNRICHMENT CVE-2026-104800 vulners.com
- CVE List V5 release 2026-10-14 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:04.
Original description (NVD)
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.
NVD references (8)
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/admin.php
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/agegate.php#L161
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L213
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L279
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L291
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L325
- https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/nonwp.php#L20
- https://www.wordfence.com/threat-intel/vulnerabilities/id/05db28b4-a3de-402d-bc5b-06d5347d6724?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.