Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104800— AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php

Quick assessment

Affected
streetforce1 AGE-GATE
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 AGE-GATE 存在远程代码执行漏洞，影响范围为 1.0 及以下所有版本。该漏洞源于插件在独立的 admin.php 端点中缺失身份验证、权限检查以及 nonce 验证机制，同时直接将未经清理的 POST 参数注入到生成并包含的 PHP 源码中。攻击者可通过构造恶意的 width（以及 height）参数实现任意代码执行。由于 admin.php 文件未加载 WordPress 核心环境，且未设置 ABSPATH 安全防护，因此无论插件是否通过模拟菜单 API 注册了表面上的权限参数，该

CVSS 9.8 · Critical EPSS 1.03% · P63

Affected Version Matrix 1

VendorProduct Version RangeStatus
streetforce1 AGE-GATE ≤ 1.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104800

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
Source: CVE Program / CVE List V5
Vulnerability Description
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
streetforce1 AGE-GATE 0 ~ 1.0 -

II. Public POCs for CVE-2026-104800

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104800

请登录查看更多情报信息。

Other References for CVE-2026-104800 (8)

IV. Related Vulnerabilities

Same weakness: CWE-434

V. Comments for CVE-2026-104800

No comments yet

Leave a comment