Remote Code Execution in Admin and Site Enhancements Pro Plugin for WordPress

CVE-2026-16610

What is CVE-2026-16610?

The Admin and Site Enhancements (ASE) Pro plugin for WordPress contains a Remote Code Execution vulnerability affecting all versions up to 8.9.0. This vulnerability arises from insufficient authentication checks in the frontend save handler, where only a publicly emitted nonce is enforced. Attackers can also bypass CAPTCHA validation by omitting a supplied key. Furthermore, repeater row keys from cfgroup[input] are stored in an unfiltered manner and directly used in an eval() call within the recursive_html function, leading to the potential for unauthenticated attackers to run arbitrary code on the server. To exploit this vulnerability, the [post_cf_form] shortcode must be present on a publicly accessible page, allowing attackers to access the nonce and session ID needed to interact with the defective save handler.

References