CVE-2026-16610 Code injection in Admin and Site Enhancements (ASE) Pro
Unauthenticated attackers can execute arbitrary code on WordPress sites using ASE Pro if a specific shortcode is present on a public page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16610?
CVE-2026-16610 is a critical code injection vulnerability in Admin and Site Enhancements (ASE) Pro, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA validation is bypassable by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server. This requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID needed to reach the vulnerable save handler are emitted to unauthenticated visitors by that shortcode.
Weakness: CWE-434
Which versions are affected by CVE-2026-16610?
How do I fix CVE-2026-16610?
No fix has been published for CVE-2026-16610 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-16610 being exploited?
There is no known exploitation of CVE-2026-16610 in the wild and no public exploit code.
Sources
Also known as GHSA-q4w9-fxpc-cjc5.