The Admin and Site Enhancements (ASE) Pro plugin for WordPress contains a remote code execution flaw in all releases up to 8.9.0. The vulnerability originates in the plugin’s recursive_html function, which takes repeater row keys supplied in cfgroup[input] and inserts them directly into an eval() call without any sanitization or validation, thereby fulfilling the conditions for CWE‑434 file upload that accepts arbitrary code. The flaw is triggered through a frontend save handler that emits only a public nonce and no authentication check, so attackers can exploit it even from an unauthenticated surface.

WordPress sites that have the ASE Pro plugin installed in any version 8.9.0 or earlier and that present the [post_cf_form] shortcode on a publicly accessible page. The shortcode emits the required nonce and session identifiers to visitors, exposing the vulnerable endpoint and enabling the injection vector.

The vulnerability carries a CVSS score of 9.8, reflecting a critical risk, while the EPSS score is below 1%, indicating a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Attackers can craft form submissions that include malicious cfgroup[input] values, causing the plugin’s eval() call to execute arbitrary PHP code on the server, with no need for user authentication.