Unauthenticated remote code execution in Admin and Site Enhancements (ASE) Pro for WordPress (CVE-2026-16610)

The Admin and Site Enhancements (ASE) Pro plugin for WordPress contains a PHP code injection vulnerability in the recursive_html function. The frontend save handler lacks authentication checks, CAPTCHA validation can be bypassed by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and spliced into an eval() call without sanitization, enabling unauthenticated remote code execution. Exploitation requires the [post_cf_form] shortcode to be present on at least one publicly accessible page. Affected versions: - <= 8.9.0 We recommend updating to: 8.9.1. CVSS 9.8 · our assessment: act_now Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef21a44-6d03-4197-b49c-d881f9831f46?source=cve Details: https://vuln.today/cve/CVE-2026-16610