The AGE-GATE WordPress plugin allows unauthenticated attackers to inject arbitrary PHP code via the width and height POST parameters sent to the admin.php endpoint. Because admin.php runs without WordPress authentication, capability checks, or nonce verification, the plugin writes these unsanitized inputs directly into a PHP source file that is included elsewhere, granting the attacker code execution on the web server. This flaw corresponds to CWE-434, where untrusted data leads to file manipulation and execution.

WordPress sites using the streetforce1 AGE-GATE plugin, all versions up to and including 1.0, are affected. The vulnerability exists in the standalone admin.php script bundled with the plugin for these legacy releases.

With a CVSS score of 9.8, this issue is considered Critical. The EPSS score of 1% indicates a low but measurable likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker needs only to send a crafted POST request to admin.php from any host; no authentication or special privileges are required, making the attack path straightforward and highly damaging if successful.