Cyber & AI intelligence
Wasteland.
Briefs indexed3476
Issues33
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-104800 2026-10-14

Unauthenticated RCE in AGE-GATE WordPress Plugin (CVE-2026-104800)

"The AGE-GATE plugin for WordPress, in all versions up to and including 1.0, contains a critical (CVSS 9.8) flaw that lets unauthenticated attackers execute code on the server."

The AGE-GATE plugin for WordPress, in all versions up to and including 1.0, contains a critical (CVSS 9.8) flaw that lets unauthenticated attackers execute code on the server.

What Is It

CVE-2026-104800 is a remote code execution vulnerability in the AGE-GATE plugin by streetforce1. Wordfence reported it, and NVD published it on 2026-10-14. NVD classifies it as CWE-434.

The flaw is in the plugin's standalone admin.php endpoint. That endpoint has no authentication, no capability checks and no nonce verification. It takes POST parameters, including the width and height values, and injects them unsanitized into generated PHP source. That source is written to a file that is later included. According to NVD, admin.php does not load WordPress and has no ABSPATH guard. Because of this, it is reachable without authentication, whatever capability arguments the plugin registers through its simulated menu API.

Why It Matters

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This means:

An attacker who can reach the vulnerable endpoint can execute arbitrary code on the web server. That code runs with the privileges of the PHP process, which could lead to full site compromise.

As of publication, this CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation. NVD status is "Received," and the record has not yet been analyzed.

What's Vulnerable

The plugin's Trac references point to the affected code in admin.php, agegate.php, main.php and nonwp.php.

Patch Status

The supplied NVD record does not list a fixed version. The CVE has no CISA KEV entry, so there is no KEV required action or due date. Every version through 1.0 is affected.

Until a fixed release is confirmed, administrators running AGE-GATE should consider deactivating and removing the plugin. Check the Wordfence advisory for updates on remediation.

Sources