CVE-2026-104800

CriticalCVSS 9.8/10Last modified Oct 15, 2026

Description

The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1048019.1The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient CVE-2026-1048039.8The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` andCVE-2026-1048058.5DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured bCVE-2026-1048065.5DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. TCVE-2026-1048071.9DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistCVE-2026-1048081.9DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistCVE-2026-1048098.4DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of CVE-2026-1048108.4This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. AuthenticationCVE-2026-1048118.4DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the prodCVE-2026-1048147.1Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.CVE-2026-1048168.5Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from confCVE-2026-1048178.7Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limit