Remote Code Execution Flaw in AGE-GATE Plugin for WordPress

CVE-2026-104800

What is CVE-2026-104800?

The AGE-GATE plugin for WordPress contains a vulnerability that allows for remote code execution. This occurs due to inadequate authentication and capability checks on the 'admin.php' endpoint, along with the lack of nonce verification and unsanitized POST parameter injection into PHP source files. Attackers can exploit this flaw as the endpoint operates independently of the WordPress framework, allowing them to execute arbitrary code without authentication. The vulnerability highlights risks associated with poorly secured entry points in plugins, which can be exploited by unauthenticated attackers.

References