Critical Remote Code Execution Vulnerability in Admin and Site Enhancements (ASE) Pro Plugin for WordPress (CVE-2026-16610)
A critical vulnerability (CVE-2026-16610, CVSS score: 9.8) was discovered in the Admin and Site Enhancements (ASE) Pro plugin for WordPress, allowing unauthenticated attackers to execute code on the server. The vulnerability affects all versions up to and including 8.9.0 and requires the [post_cf_form] shortcode to be present on at least one publicly accessible page. Immediate action is required to update the plugin to a patched version.