CVE-2026-16610 in Admin and Site Enhancements Pro Plugin
Summary
by MITRE • 07/30/2026
The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA validation is bypassable by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server. This requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID needed to reach the vulnerable save handler are emitted to unauthenticated visitors by that shortcode.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in the Admin and Site Enhancements Pro plugin for WordPress represents a critical remote code execution flaw affecting all versions up to and including 8.9.0. This issue stems from a fundamental misconfiguration in the plugin's frontend handling mechanism where the recursive_html function processes user-supplied data without adequate sanitization or validation measures. The vulnerability architecture allows unauthenticated attackers to exploit multiple weak points in the plugin's security model, creating a pathway for arbitrary code execution on affected WordPress installations.
The technical flaw manifests through several interconnected weaknesses that together create a complete attack vector. The frontend save handler implements only a publicly emitted nonce without proper authentication checks, meaning that any visitor who can access a page containing the [post_cf_form] shortcode can potentially trigger the vulnerable code path. This nonce-based protection is insufficient because it's designed for legitimate front-end form submissions rather than secure server-side processing. Additionally, CAPTCHA validation can be bypassed by simply omitting the attacker-supplied key from the request parameters, removing any effective anti-automation controls.
The most dangerous aspect of this vulnerability lies in how the plugin processes repeater row keys from the cfgroup[input] parameter. These keys are stored verbatim without any sanitization or identifier validation before being spliced into an eval() call within the recursive_html function. This creates a classic code injection vulnerability where attacker-controlled input directly influences server-side code execution. The CWE-94 weakness classification applies here as the plugin fails to properly validate and sanitize user inputs before incorporating them into executable code contexts, making it susceptible to arbitrary command injection attacks.
The operational impact of this vulnerability is severe for WordPress administrators and website owners who use this plugin, as it allows complete server compromise without requiring authentication credentials. Attackers can execute malicious code with the privileges of the web server process, potentially leading to data theft, website defacement, or further network compromise. The requirement for the [post_cf_form] shortcode to be present on at least one publicly accessible page means that any WordPress site using this plugin and having such a shortcode anywhere in their content is vulnerable to exploitation.
Organizations should immediately implement mitigations including disabling or removing the vulnerable plugin until a patched version is available, ensuring that no public pages contain the [post_cf_form] shortcode when the plugin remains active, and monitoring for suspicious activity on affected systems. The ATT&CK framework classification would place this under T1059.001 for command and scripting interpreter with eval() usage, and potentially T1566 for credential access through social engineering if attackers attempt to bypass CAPTCHA mechanisms. Regular security audits should verify that no other plugins contain similar patterns of unsanitized user input being passed directly into executable functions, as this represents a common pattern in web application vulnerabilities that requires strict input validation and output encoding practices.