CVE-2026-16610

Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key

View on CVE.org

Published Jul 30, 2026 CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Description

The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA validation is bypassable by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server. This requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID needed to reach the vulnerable save handler are emitted to unauthenticated visitors by that shortcode.

Analysis

Technical impact

The Admin and Site Enhancements (ASE) Pro plugin for WordPress contains a remote code execution flaw in all releases up to 8.9.0. The vulnerability originates in the plugin’s recursive_html function, which takes repeater row keys supplied in cfgroup[input] and inserts them directly into an eval() call without any sanitization or validation, thereby fulfilling the conditions for CWE‑434 file upload that accepts arbitrary code. The flaw is triggered through a frontend save handler that emits only a public nonce and no authentication check, so attackers can exploit it even from an unauthenticated surface.

Affected Systems

WordPress sites that have the ASE Pro plugin installed in any version 8.9.0 or earlier and that present the [post_cf_form] shortcode on a publicly accessible page. The shortcode emits the required nonce and session identifiers to visitors, exposing the vulnerable endpoint and enabling the injection vector.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8, reflecting a critical risk, while the EPSS score is below 1%, indicating a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Attackers can craft form submissions that include malicious cfgroup[input] values, causing the plugin’s eval() call to execute arbitrary PHP code on the server, with no need for user authentication.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ASE

Admin and Site Enhancements (ASE) Pro

unaffected

Version	Status	Constraints
`0`	affected	≤ 8.9.0

No data.

Vendor Product Versions

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Wpase

Admin And Site Enhancements

Version	Status	Scheme	Platform
`[0,8.9.0]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor‑issued patch or upgrade the ASE Pro plugin to the latest available release that removes the unsanitized eval usage.
If the plugin cannot be upgraded immediately, delete or disable the [post_cf_form] shortcode from all publicly accessible pages so that the required nonce and session details are not exposed to unauthenticated users.
Configure the web server or firewall to block or require authentication for requests to the ASE Pro save‑handler endpoint, preventing unauthenticated exploitation of the vulnerable function.

Generated by OpenCVE AI on August 4, 2026 at 11:51 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.1% (1.073% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef21a44-6d03-4197-b49c-d881f9831f46?source=cve
https://www.wpase.com/

History

Jul 30, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 30, 2026 1:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress Wpase Wpase admin And Site Enhancements
Vendors & Products		Wordpress Wordpress wordpress Wpase Wpase admin And Site Enhancements

Jul 30, 2026 4:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA validation is bypassable by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server. This requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID needed to reach the vulnerable save handler are emitted to unauthenticated visitors by that shortcode.
Title		Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key
Weaknesses		CWE-434
References		https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef21a44-6d03-4197-b49c-d881f9831f46?source=cve https://www.wpase.com/
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`