CVE-2026-104800 streetforce1 CVE debrief

Who should care

WordPress administrators and security teams responsible for maintaining WordPress installations with the AGE-GATE plugin should assess exposure and prioritize remediation. They should review the plugin version and update it to a version beyond 1.0 if possible. Additionally, they should restrict access to the admin.php endpoint, monitor server logs for suspicious activity, and consider implementing additional security measures such as a Web Application.

Why it matters

The CVE-2026-104800 vulnerability in the AGE-GATE plugin for WordPress allows unauthenticated attackers to execute code on the server, posing a critical risk to WordPress installations using version 1.0 or earlier.

• Unauthenticated attackers can execute code on the server.
• Missing authentication and capability checks allow for exploitation.
• Unsanitized injection of POST parameters enables code injection.
• Remediation priority is high due to the critical severity of the vulnerability.

Technical summary

The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0. The vulnerability exists due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This allows unauthenticated attackers to execute code on the server, posing a critical risk to WordPress installations using version 1.0 or earlier. The vulnerability is exacerbated by the fact that admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point.

Defensive priority

High priority remediation is recommended for WordPress installations using the AGE-GATE plugin version 1.0 or earlier, as unauthenticated attackers can execute code on the server.

Recommended defensive actions

• Immediately update the AGE-GATE plugin to a version beyond 1.0 if possible.
• Restrict access to the admin.php endpoint.
• Monitor server logs for suspicious activity.
• Consider implementing additional security measures such as a Web Application Firewall (WAF).
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and parameters. However, there is limited information on potential exploits or attacks. Defenders should verify the presence of the AGE-GATE plugin version 1.0 or earlier in their WordPress installations and assess exposure. They should also review server logs for suspicious activity and consider implementing additional security measures such as a Web Application Firewall (WAF).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.