ASE Pro WordPress Plugin Vulnerable to Remote Code Execution
The Admin and Site Enhancements (ASE) Pro plugin for WordPress reportedly contains a critical vulnerability that could allow remote code execution.
What happened
The ASE Pro plugin for WordPress, in all versions up to and including 8.9.0, appears to be vulnerable to Remote Code Execution (RCE) due to insufficient nonce validation and lack of sanitization in the recursive_html function. This vulnerability, tracked as CVE-2026-16610, has a CVSS score of 9.8, indicating a critical severity level. The issue arises from the frontend save handler enforcing only a publicly emitted nonce with no authentication check, CAPTCHA validation being bypassable, and repeater row keys from cfgroup[input] being stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server, provided the [post_cf_form] shortcode is present on at least one publicly accessible page. The vulnerability is under investigation, and users are advised to consult primary sources for the latest information and recommended actions.
How 0Day mitigates this
ase pro is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.