Admin And Site Enhancements Ase Pro
Monthly
Remote code execution in the Admin and Site Enhancements (ASE) Pro plugin for WordPress (versions up to and including 8.9.0) allows unauthenticated attackers to run arbitrary PHP on the server. The flaw chains three weaknesses in the frontend custom-form save handler - a publicly emitted nonce with no auth check, a CAPTCHA that is bypassed by simply omitting the attacker-supplied key, and unsanitized repeater-row keys from cfgroup[input] that are spliced directly into an eval() call in recursive_html. Reported by Wordfence; with a CVSS of 9.8 and CWE-434, this is a critical, network-exploitable issue, though no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored/reflected cross-site scripting in the Admin and Site Enhancements (ASE) Pro WordPress plugin (versions 8.8.5 and earlier) allows unauthenticated remote attackers to inject malicious scripts that execute in a victim's browser once they view the affected page or follow a crafted link. Because the flaw requires no authentication and carries a scope-changing CVSS 3.1 score of 9.6, a single successful lure can lead to admin session hijacking and full site takeover. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in the Admin and Site Enhancements (ASE) Pro plugin for WordPress (versions up to and including 8.9.0) allows unauthenticated attackers to run arbitrary PHP on the server. The flaw chains three weaknesses in the frontend custom-form save handler - a publicly emitted nonce with no auth check, a CAPTCHA that is bypassed by simply omitting the attacker-supplied key, and unsanitized repeater-row keys from cfgroup[input] that are spliced directly into an eval() call in recursive_html. Reported by Wordfence; with a CVSS of 9.8 and CWE-434, this is a critical, network-exploitable issue, though no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored/reflected cross-site scripting in the Admin and Site Enhancements (ASE) Pro WordPress plugin (versions 8.8.5 and earlier) allows unauthenticated remote attackers to inject malicious scripts that execute in a victim's browser once they view the affected page or follow a crafted link. Because the flaw requires no authentication and carries a scope-changing CVSS 3.1 score of 9.6, a single successful lure can lead to admin session hijacking and full site takeover. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.