A critical (CVSS 9.8) remote code execution flaw in the Admin and Site Enhancements (ASE) Pro plugin for WordPress lets unauthenticated attackers run arbitrary code on sites exposing the [post_cf_form] shortcode.
What Is It
The vulnerability lives in the recursive_html function of ASE Pro. Three failures chain together:
- No authentication check. The frontend save handler validates only a nonce that is publicly emitted to anonymous visitors.
- Bypassable CAPTCHA. Per the Wordfence writeup, validation can be skipped by omitting the request parameter that triggers the check, so an attacker simply does not send it.
- Unsanitized input into
eval(). Repeater row keys fromcfgroup[input]are stored verbatim and later spliced into aneval()call with no sanitization or identifier validation.
The result is unauthenticated code execution on the server. The CVE was assigned by Wordfence.
One caveat on classification: the record is tagged CWE-434 (Unrestricted Upload of File with Dangerous Type), but the root cause described in the source material is untrusted input reaching eval(), behavior that maps to code injection (CWE-94 / CWE-95), not file upload. The assigned CWE and the technical description do not agree; defenders should triage against the eval() sink described above rather than against upload-handling controls.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with full confidentiality, integrity, and availability impact. That is the profile attackers automate first. Successful exploitation yields code execution in the web server context, which in a WordPress deployment means the full site and its database are in play.
What's Vulnerable
- Product: Admin and Site Enhancements (ASE) Pro plugin for WordPress
- Vendor: ASE (wpase.com)
- Affected versions: all versions up to and including 8.9.0
There is an important precondition: the [post_cf_form] shortcode must be present on at least one publicly accessible page. That shortcode is what emits the nonce and session ID an unauthenticated visitor needs to reach the vulnerable save handler. Sites running ASE Pro without that shortcode publicly exposed appear not to be reachable via this specific path, but that is a statement about the one exploitation route documented here, not a clean bill of health. The same eval() sink may be reachable through other entry points that have not been analyzed, and administrators should not treat the absence of the shortcode as equivalent to being unaffected.
Patch Status
The available source material does not list a fixed version, vendor advisory, or remediation guidance. The NVD entry, publication date, and a record status of Deferred, should be confirmed directly against the NVD record for CVE-2026-16610 before being relied on for reporting or SLA decisions; these fields change over time and are not independently verified here.
Likewise, no CISA KEV entry for this CVE appeared in the material reviewed. That is an absence of evidence, not evidence of absence: it means no exploitation was confirmed in the data available, not that the CVE is definitively absent from KEV. Check the KEV catalog directly to determine whether a federal remediation deadline applies.
Defenders should treat the shortcode precondition as the fastest available triage signal while awaiting vendor guidance, and should track the vendor site for a patched release above 8.9.0.
Sources
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef21a44-6d03-4197-b49c-d881f9831f46?source=cve
- NVD, CVE-2026-16610, https://nvd.nist.gov/vuln/detail/CVE-2026-16610
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- ASE Vendor Site: https://www.wpase.com/