AGE-GATE Plugin EUVD-2026-100785

No special conditions - remote unauthenticated exploitation against default configurations of the AGE-GATE WordPress plugin (all versions up to and including 1.0). The standalone admin.php endpoint deliberately does not bootstrap WordPress and has no ABSPATH guard, so the registered capability/nonce arguments are decorative and provide no protection. The only prerequisites are that the vulnerable plugin is installed/active and that admin.php is directly reachable over HTTP; the capability checks advertised via the plugin's simulated menu API do NOT limit exploitation because that code path never runs for direct requests.

All available signals point to maximum real-world risk if the plugin is present. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no privileges and no user interaction, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) for a 9.8 CRITICAL score. The description independently corroborates this: admin.php is a standalone endpoint that does not load WordPress, carries no ABSPATH guard, and injects unsanitized POST parameters into generated PHP written to an included file - so the 'unauthenticated' claim is consistent with PR:N rather than merely inferred from text. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so there is no confirmation of in-the-wild or automated exploitation; by the precision rules this is 'no public exploit identified at time of analysis.' The absence of exploitation telemetry does NOT lower the technical severity - unauthenticated RCE with no preconditions is trivially weaponizable and should be treated as a top-priority patch, with the only genuine mitigating factor being how widely this specific plugin is actually deployed.

An unauthenticated attacker sends a crafted HTTP POST request directly to the plugin's standalone admin.php endpoint, supplying a malicious payload in the 'width' (and 'height') parameter. Because the endpoint performs no authentication, capability, or nonce checks and writes the parameter straight into generated PHP source in an included file, the injected code executes on the server. No public exploit was identified in the provided data, but the attack is low-complexity and requires no privileges or user interaction per the CVSS vector.