External risk intelligence

AGE-GATE WordPress Plugin Unauthenticated Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-104800

The vulnerability affects a WordPress plugin, which is a type of web application component commonly deployed on public-facing websites. Because the flaw exists in a standalone endpoint that bypasses standard authentication and WordPress framework guards, it creates an unauthenticated, internet-reachable entry point on any server hosting the plugin.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the AGE-GATE WordPress plugin that could allow unauthenticated attackers to execute code on your server. This issue stems from how the plugin handles certain parameters, bypassing standard security checks and WordPress safeguards. The potential for remote code execution means that if your organization uses this plugin, unauthorized parties could gain control of your web server, impacting operations and data.

Unauthenticated code execution via a WordPress plugin.
High impact if the plugin is used on any of your sites.
Confirm plugin usage; address if present.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can reach a vulnerable endpoint directly over the internet. This endpoint allows for unsanitized POST parameters to be injected into a file, which can then be used to execute arbitrary code on the server.

No authentication or specific user privileges are required.
An attacker triggers the vulnerability by sending specially crafted POST requests.
Risk includes remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could execute arbitrary code on the server when the AGE-GATE plugin for WordPress is installed. This could impact the integrity and availability of the website and its underlying server when accessed through a standalone admin.php endpoint without proper authentication, capability checks, or nonce verification.

Server-side code execution.
Via unauthenticated admin.php endpoint.
Compromise website and server.

Operational Fix

Recommended remediation, mitigation, and detection steps

For this critical remote code execution vulnerability in the AGE-GATE WordPress plugin, application owners or the web development team are likely responsible for remediation. The initial practical step is to identify all WordPress instances running the plugin, confirm if they are internet-reachable, and then determine the business criticality to prioritize the response.

Confirm plugin use and reachability.
Identify accountable application owner.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the AGE-GATE plugin?

AGE-GATE is an add-on component for WordPress websites used to restrict visitor access, typically to verify age before displaying content. It functions as a plugin, meaning it integrates directly into the WordPress environment to extend site features. Because it adds specific code to handle user interactions and page displays, it becomes a part of the server-side logic of any WordPress site that has it installed and active.

What does CWE-434 mean for CVE-2026-104800?

This vulnerability is classified under CWE-434, which refers to Unrestricted Upload of File with Dangerous Type. In this specific case, the plugin allows user-supplied data to be written directly into a PHP file on the server. Because the plugin fails to sanitize this input, an attacker can inject malicious commands. The server treats this injected text as executable code rather than plain data, enabling the attacker to run unauthorized operations.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted POST request to a standalone file named admin.php within the plugin. Crucially, the plugin's design allows this endpoint to run without loading the core WordPress security framework. This means the request does not need to bypass a login screen or administrative privileges; the code executes simply because the endpoint is accessible, regardless of the user's status.

Is my site at risk if it uses this plugin?

According to Halo Surface Signal, this vulnerability is particularly concerning because the affected endpoint functions as an unauthenticated, internet-reachable gateway. If your WordPress site is public-facing and has this plugin installed, the entry point is exposed to the open web. This allows anyone with network access to the server to potentially trigger the vulnerability without needing prior authorization or valid credentials.

What should I do if I use this plugin?

Your first priority is to locate all WordPress instances within your environment that currently have the AGE-GATE plugin active. Once identified, evaluate whether the plugin is essential for your site's operations. Given the severity of this remote code execution flaw, consider disabling or removing the plugin immediately if it is not strictly required until a secure version is available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.