Executive Summary

A critical vulnerability (CVE-2026-16610, CVSS score: 9.8) was discovered in the Admin and Site Enhancements (ASE) Pro plugin for WordPress, allowing unauthenticated attackers to execute code on the server. The vulnerability affects all versions up to and including 8.9.0 and requires the [post_cf_form] shortcode to be present on at least one publicly accessible page. Immediate action is required to update the plugin to a patched version.

Technical Analysis

The vulnerability is classified as a Remote Code Execution (RCE) vulnerability. The attack vector involves an unauthenticated attacker exploiting the frontend save handler of the ASE Pro plugin, which enforces only a publicly emitted nonce with no authentication check. The CAPTCHA validation can be bypassed by omitting an attacker-supplied key. The repeater row keys from cfgroup[input] are stored verbatim and later spliced into an eval() call in the recursive_html function without any sanitization or identifier validation.

How It Gets Exploited

An unauthenticated remote attacker on the same network or with access to a publicly accessible page containing the [post_cf_form] shortcode can exploit this vulnerability. The attacker would send a crafted request to the vulnerable save handler, omitting the CAPTCHA key and including a malicious repeater row key. The vulnerable code would then store the malicious key verbatim and later execute it in the recursive_html function using eval(), allowing the attacker to execute arbitrary code on the server.

Impact Assessment

The vulnerability affects all versions of the ASE Pro plugin up to and including 8.9.0. An attacker can achieve arbitrary code execution on the server, which can lead to a complete compromise of the system. The CVSS score of 9.8 indicates a critical vulnerability with high impacts on confidentiality, integrity, and availability.

Recommended Actions

Update the Admin and Site Enhancements (ASE) Pro plugin to a patched version (9.0 or later) as soon as possible. Ensure that the [post_cf_form] shortcode is not present on any publicly accessible page, or restrict access to the shortcode to authenticated users only. Monitor your WordPress installation for any suspicious activity and consider implementing additional security measures, such as a web application firewall (WAF) to detect and prevent exploitation attempts.

Sources

  • National Vulnerability Database (NVD)
  • Wordfence
  • WPASE