CVE-2026-104800: CWE-434 Unrestricted Upload of File with Dangerous Type in streetforce1 AGE-GATE

CVE-2026-104800 affects the AGE-GATE plugin for WordPress, versions up to 1.0. The vulnerability arises from the admin.php endpoint, which does not enforce authentication or capability checks and lacks nonce verification. This endpoint also does not load WordPress core (no ABSPATH guard), making it fully accessible without authentication. Attackers can exploit this by sending crafted POST requests with parameters such as 'width' and 'height' that are unsanitized and injected directly into PHP source code written to an included file, resulting in remote code execution on the server.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server hosting the vulnerable plugin. This can lead to full system compromise, data theft, service disruption, or further attacks within the affected environment. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint if possible, and consider disabling or removing the AGE-GATE plugin to prevent exploitation.