WORDPRESS · JULY 2026 · EARLY WARNING

ASE Pro WordPress Plugin Vulnerable to Remote Code Execution

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
CVE-2026-16610Severity: CRITICAL

The Admin and Site Enhancements (ASE) Pro plugin for WordPress reportedly contains a critical vulnerability that could allow remote code execution.

What happened

The ASE Pro plugin for WordPress, in all versions up to and including 8.9.0, appears to be vulnerable to Remote Code Execution (RCE) due to insufficient nonce validation and lack of sanitization in the recursive_html function. This vulnerability, tracked as CVE-2026-16610, has a CVSS score of 9.8, indicating a critical severity level. The issue arises from the frontend save handler enforcing only a publicly emitted nonce with no authentication check, CAPTCHA validation being bypassable, and repeater row keys from cfgroup[input] being stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server, provided the [post_cf_form] shortcode is present on at least one publicly accessible page. The vulnerability is under investigation, and users are advised to consult primary sources for the latest information and recommended actions.

How 0Day mitigates this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If ase pro is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Join the 0Day waitlist →

← Back to all threats