WordPress AGE-GATE Plugin CVE-2026-104800 Lets Attackers Run Code Without Login
All versions of the WordPress AGE-GATE plugin through 1.0 contain a critical flaw that lets attackers run code on servers without logging in.
Key points
- The vulnerability is tracked as CVE-2026-104800 with a CVSS score of 9.8.
- All versions of the AGE-GATE plugin up to and including 1.0 are affected.
- No patch or fix has been confirmed by the vendor at this time.
The WordPress AGE-GATE plugin, developed by streetforce1, contains a critical security flaw in every version released up to and including 1.0. According to the National Vulnerability Database, this issue allows unauthenticated attackers to execute arbitrary code on affected servers. The vulnerability stems from missing authentication checks and unsanitized input handling within the plugin’s administrative interface.
How it unfolded
- The National Vulnerability Database recorded CVE-2026-104800 with a CVSS score of 9.8.
- Researchers identified that the standalone admin.php endpoint lacks standard WordPress security guards.
- The flaw enables remote code execution via the width and height parameters without user interaction.
Who is affected
Any WordPress installation running the AGE-GATE plugin in version 1.0 or earlier is vulnerable. The flaw exists because the plugin’s admin.php file does not load the core WordPress environment or include the ABSPATH guard. This creates an unauthenticated entry point that bypasses capability checks and nonce verification. Attackers can inject POST parameters directly into generated PHP source code, which is then written to an included file.
Our take on the response
This vulnerability mirrors the severity of recent flaws in other web platforms, such as the Adobe ColdFusion authorization issue reported by Patch Observer on 2026-10-13. The lack of authentication on the admin endpoint makes this flaw particularly dangerous, as it requires no user interaction. That suggests administrators must prioritize immediate containment measures since no vendor patch is currently available to mitigate the risk.
Who needs to act first
Managed service providers should immediately identify all client sites hosting the AGE-GATE plugin. Teams usually begin by isolating affected web servers from public networks to prevent exploitation. It is critical to back up current site configurations before making any changes. Since no fix exists, administrators must disable the plugin entirely or remove it from the server. Monitoring access logs for unusual POST requests to admin.php helps detect potential exploitation attempts while a permanent solution is awaited.
What to do and how to stay safe: WordPress
- Disable or uninstall the AGE-GATE plugin on all WordPress installations immediately.
- Monitor server access logs for suspicious POST requests targeting the plugin’s admin endpoint.
- Restrict access to administrative files using web server rules if the plugin must remain active.
- Wait for an official update from the vendor before reinstalling the plugin.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-104800?
The National Vulnerability Database rates the severity of CVE-2026-104800 as 9.8, which is critical.
Which versions of the AGE-GATE plugin are vulnerable?
All versions of the plugin up to and including version 1.0 are affected by this flaw.
Is there a patch available for this vulnerability?
No fix has been confirmed yet by the vendor or security researchers.
