EUVD-2026-50967
GHSA-q4w9-fxpc-cjc5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network RCE with no user interaction; the required public [post_cf_form] shortcode is a deployment precondition, not added attack complexity, and code execution yields full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA validation is bypassable by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server. This requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID needed to reach the vulnerable save handler are emitted to unauthenticated visitors by that shortcode.
AnalysisAI
Remote code execution in the Admin and Site Enhancements (ASE) Pro plugin for WordPress (versions up to and including 8.9.0) allows unauthenticated attackers to run arbitrary PHP on the server. The flaw chains three weaknesses in the frontend custom-form save handler - a publicly emitted nonce with no auth check, a CAPTCHA that is bypassed by simply omitting the attacker-supplied key, and unsanitized repeater-row keys from cfgroup[input] that are spliced directly into an eval() call in recursive_html. Reported by Wordfence; with a CVSS of 9.8 and CWE-434, this is a critical, network-exploitable issue, though no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerable component is the ASE Pro plugin's custom-fields/custom-form feature exposed through the [post_cf_form] shortcode. The root cause is a dangerous dynamic code path: the recursive_html function builds and evaluates PHP via eval(), and user-controlled repeater row identifiers submitted as cfgroup[input] are stored verbatim and later interpolated into that eval() call without identifier validation or sanitization. Although the CVE is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), the described mechanism is more precisely a code-injection-into-eval() (akin to CWE-94/CWE-95); the CWE tag should be treated as an approximation of the file-upload/RCE tag set (WordPress, File Upload, RCE). The CPE cpe:2.3:a:ase:admin_and_site_enhancements_(ase)_pro identifies the affected product as the paid Pro edition of the ASE plugin from wpase.com.
RemediationAI
Upgrade ASE Pro to a fixed release above 8.9.0 as published by the vendor at https://www.wpase.com/; no exact patched version number was provided in the input data, so confirm the current fixed version directly with the vendor or the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef21a44-6d03-4197-b49c-d881f9831f46?source=cve) before deploying. As an immediate compensating control while patching, remove or disable the [post_cf_form] shortcode from all publicly accessible pages, which severs the anonymous path that emits the nonce and session ID needed to reach the vulnerable save handler - the trade-off is that public custom-form submissions will stop working. Where the form must remain live, place it behind authentication or IP restriction and deploy a WAF rule (e.g. Wordfence) to block cfgroup[input] payloads containing PHP identifiers/expressions, accepting that WAF signatures may be bypassable and are a stopgap, not a fix.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today