CVE-2026-104800

The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.

• CWE-434

• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/admin.php
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/agegate.php#L161
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L213
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L279
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L291
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L325
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/nonwp.php#L20
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05db28b4-a3de-402d-bc5b-06d5347d6724?source=cve

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104769The Debloat – Remove Unused CSS, Optimize JS plugin for Word…5.9
• CVE-2026-104774OWASP Coraza WAF is a golang modsecurity compatible web appl…5.8
• CVE-2026-104795The insights-runtime-extractor runs as a privileged DaemonSe…8.8
• CVE-2026-104797The Advanced Form Integration — Connect Forms to 300+ Apps p…8.1
• CVE-2026-104798The My Calendar – Accessible Event Manager plugin for WordPr…9.8
• CVE-2026-1048A weakness has been identified in LigeroSmart up to 6.1.26. …5.4
• CVE-2026-104801The PPOM – Product Addons & Custom Fields for WooCommerce pl…9.1
• CVE-2026-104803The WPCOM Member plugin for WordPress is vulnerable to Authe…9.8
• CVE-2026-104805DigitalCanion has discovered a vulnerability in the backup r…8.5
• CVE-2026-104806DigitalCanion has discovered a path traversal vulnerability …5.5
• CVE-2026-104807DigitalCanion has discovered a stored Cross-Site Scripting (…1.9
• CVE-2026-104808DigitalCanion has discovered a stored Cross-Site Scripting (…1.9