CVE-2026-16610 Details
Description
The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA validation is bypassable by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server. This requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID needed to reach the vulnerable save handler are emitted to unauthenticated visitors by that shortcode.
A remote code execution vulnerability has been identified in the Admin and Site Enhancements (ASE) Pro plugin for WordPress, affecting all versions through 8.9.0. The vulnerability arises in the 'recursive_html' function, where the frontend save handler only verifies a publicly available nonce without proper authentication. This flaw allows unauthenticated attackers to bypass CAPTCHA validation and inject malicious code. The issue is exacerbated by repeater row keys from 'cfgroup[input]' being directly inserted into an 'eval()' call within 'recursive_html', without any sanitization or validation. Exploitation requires the '[post_cf_form]' shortcode to be active on a publicly accessible page, as this shortcode exposes the necessary nonce and session ID to unauthenticated users.
Users are advised to update the Admin and Site Enhancements (ASE) Pro plugin to version 8.9.1 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef21a44-6d03-4197-b49c-d881f9831f46?source=cve | [email protected] | AdvisoryRemedy |
| https://www.wpase.com/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Admin and Site Enhancements | <= 8.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |