AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-104800 · Microsoft / collected KEV context

cve-program · CVE-2026-104800

• https://www.wordfence.com/threat-intel/vulnerabilities/id/05db28b4-a3de-402d-bc5b-06d5347d6724?source=cve
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L279
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L325
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L213
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/main.php#L291
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/admin.php
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/agegate.php#L161
• https://plugins.trac.wordpress.org/browser/wp-site-age-gate/trunk/nonwp.php#L20

No related operational record is retained in the current change model.