WordPress AGE-GATE RCE: Admin.php Input Flaw Enables Unauthenticated Code Execution

The AGE-GATE plugin for WordPress contains a critical remote code execution flaw that exposes sites to unauthenticated attacks. This vulnerability affects all releases up to and including version 1.0, created by streetforce1. Security teams managing WordPress environments should assess their exposure immediately, as the bug allows attackers to run arbitrary code on affected servers without needing user credentials or prior access.

Root cause

The vulnerability arises from a standalone admin.php endpoint that fails to load the core WordPress environment. According to the NVD record, this file lacks an ABSPATH guard and does not perform necessary authentication, capability checks, or nonce verification. Consequently, the endpoint operates as a fully unauthenticated entry point. This bypasses the simulated menu API’s decorative capability arguments, leaving the server exposed to direct manipulation.

Attack path

Attackers exploit this by sending POST requests containing unsanitized parameters, specifically targeting the 'width (and height)' inputs. The plugin injects these values directly into generated PHP source code, which is then written to an included file. This mechanism allows an unauthenticated attacker to execute arbitrary commands on the server. The lack of input sanitisation combined with the missing authentication checks creates a direct path to remote code execution.

Affected versions

• All versions of the AGE-GATE plugin up to and including version 1.0 are affected by this vulnerability.

Mitigation

• Remove the AGE-GATE plugin from all WordPress installations until a secure update is released.
• Restrict access to the admin.php endpoint at the web server or firewall level if removal is not immediately possible.
• Monitor server logs for unusual POST requests targeting the plugin's parameters.
• Verify that no unauthorized PHP files have been created or modified on affected servers.

Signals worth monitoring

Security operations teams should examine web server access logs for POST requests directed at the plugin’s admin.php file, particularly those containing large or encoded payloads in width or height parameters. Look for unexpected file creation events in the plugin’s directory, which may indicate successful code injection.

Additionally, monitor for outbound network connections from the web server process to unknown external hosts, as this could signal command execution. Check for new or modified PHP files with recent timestamps, as the flaw writes generated source code to included files. Teams should also review authentication logs for any anomalies, although the attack bypasses standard login mechanisms.

What to do and how to stay safe: WordPress

• Audit your WordPress installations to identify any sites running the AGE-GATE plugin.
• Isolate affected servers from the network if you suspect compromise while preparing for remediation.
• Review file integrity monitoring alerts for changes to PHP files in plugin directories.
• Once the vendor provides an update, test it in a staging environment before deploying to production.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the AGE-GATE plugin are vulnerable?

All versions up to and including version 1.0 are affected by this remote code execution flaw.

Does an attacker need to log in to exploit this vulnerability?

No, the vulnerability allows unauthenticated attackers to execute code without any login credentials.

What is the CVSS score for CVE-2026-104800?

The National Vulnerability Database rates this vulnerability as critical with a CVSS score of 9.8.