CVE-2026-16610
Deferred Deferred - Pending Action

Remote Code Execution in Admin and Site Enhancements Pro WordPress Plugin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Wordfence

Description
The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA validation is bypassable by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server. This requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID needed to reach the vulnerable save handler are emitted to unauthenticated visitors by that shortcode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-16610
EUVD
EUVD-2026-50967

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpbeaverbuilder admin_and_site_enhancements_pro to 8.9.0 (inc)
wpase admin_and_site_enhancements_pro to 8.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Admin and Site Enhancements (ASE) Pro plugin for WordPress has a Remote Code Execution vulnerability in versions up to 8.9.0. The issue is in the recursive_html function due to three flaws: no authentication check on a publicly emitted nonce, bypassable CAPTCHA validation, and unsanitized repeater row keys spliced into an eval() call. Attackers can exploit this without authentication if the [post_cf_form] shortcode is present on a public page.

Detection Guidance

Check if the Admin and Site Enhancements (ASE) Pro plugin version 8.9.0 or lower is installed on your WordPress site. Look for the [post_cf_form] shortcode in publicly accessible pages as it emits the nonce and session ID needed for exploitation.

Impact Analysis

Unauthenticated attackers could execute arbitrary code on your server. This could lead to full system compromise, data theft, malware installation, or website defacement. The attack requires only that the vulnerable shortcode is present on a public page.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. A successful exploit may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Immediately update the ASE Pro plugin to the latest version beyond 8.9.0. If an update is unavailable, consider disabling the plugin or removing the [post_cf_form] shortcode from all pages until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart