CVE-2026-16610 Overview
CVE-2026-16610 is a critical unauthenticated Remote Code Execution vulnerability in the Admin and Site Enhancements (ASE) Pro plugin for WordPress. The flaw affects all versions up to and including 8.9.0. Attackers can execute arbitrary PHP code on the server without authentication when the [post_cf_form] shortcode is present on a publicly accessible page. The vulnerability resides in the recursive_html function, where attacker-controlled repeater row keys are spliced into an eval() call without sanitization. The frontend save handler enforces only a publicly emitted nonce and lacks any authentication check, while CAPTCHA validation can be bypassed by omitting a specific key.
Critical Impact
Unauthenticated attackers can achieve full remote code execution on WordPress sites running vulnerable ASE Pro versions, leading to complete site compromise.
Affected Products
- Admin and Site Enhancements (ASE) Pro plugin for WordPress
- All versions up to and including 8.9.0
- Sites hosting the [post_cf_form] shortcode on any publicly accessible page
Discovery Timeline
- 2026-07-30 - CVE-2026-16610 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-16610
Vulnerability Analysis
The vulnerability is classified as Unrestricted Upload of File with Dangerous Type [CWE-434] and results in Remote Code Execution. The root defect lies in the ASE Pro plugin's frontend contact form save handler, which processes submissions from the [post_cf_form] shortcode. The handler emits both the nonce and session ID to unauthenticated visitors, allowing any user who loads a page containing the shortcode to obtain the tokens required to invoke the save handler.
The recursive_html function later processes stored form configuration data. Repeater row keys submitted through the cfgroup[input] parameter are stored verbatim without validation. When the plugin renders form structures, these attacker-supplied keys are concatenated directly into an eval() call, allowing arbitrary PHP execution in the web server context.
Root Cause
Three compounding defects produce the vulnerability. First, the save handler performs no authentication check and relies solely on a nonce that is publicly emitted. Second, CAPTCHA validation can be bypassed by omitting an attacker-supplied key rather than providing an incorrect value. Third, repeater row keys from cfgroup[input] are stored and later spliced into an eval() statement without identifier validation or sanitization.
Attack Vector
An unauthenticated attacker locates any public page rendering the [post_cf_form] shortcode and extracts the emitted nonce and session ID. The attacker then submits a crafted request to the save handler with malicious PHP payloads placed in repeater row keys of the cfgroup[input] parameter. When the plugin subsequently invokes recursive_html, the payload is executed by eval() on the server.
No verified exploit code is publicly available. See the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-16610
Indicators of Compromise
- POST requests to the ASE Pro frontend save handler containing unusual bracket notation or PHP function names within cfgroup[input] parameters.
- New or modified PHP files in the WordPress uploads, plugins, or themes directories following form submissions.
- Web shells, cron entries, or administrative user accounts created without corresponding authenticated admin sessions.
- Outbound network connections from the web server process to unfamiliar hosts shortly after form POST requests.
Detection Strategies
- Inspect web server access logs for POST requests targeting ASE Pro AJAX or form endpoints from unauthenticated sources.
- Alert on WordPress file integrity changes affecting core, plugin, or theme PHP files.
- Monitor PHP error and audit logs for eval() invocations originating from the ASE Pro plugin directory.
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin option changes and configuration writes.
- Deploy a web application firewall with rules matching suspicious cfgroup[input] payloads containing PHP tokens.
- Track outbound connections from www-data or equivalent web server accounts to detect post-exploitation callbacks.
How to Mitigate CVE-2026-16610
Immediate Actions Required
- Update the Admin and Site Enhancements (ASE) Pro plugin to a version later than 8.9.0 as soon as the vendor releases a fix.
- Remove or disable the [post_cf_form] shortcode from all publicly accessible pages until the plugin is patched.
- Audit the WordPress filesystem for unauthorized PHP files and review administrator accounts for unexpected additions.
Patch Information
Refer to the Wordfence Vulnerability Report and the WPASE Security Resource for vendor patch status. Sites should upgrade to the first fixed version once published by the vendor.
Workarounds
- Deactivate the ASE Pro plugin entirely until a patched release is available.
- Restrict access to pages that render the [post_cf_form] shortcode using authentication or IP allowlisting.
- Deploy WAF signatures that block requests containing PHP metacharacters or function names inside cfgroup[input] fields.
- Enforce least-privilege filesystem permissions on the WordPress installation to limit write access from the web server user.
# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate admin-site-enhancements-pro
# Verify no shortcode instances remain on published content
wp post list --post_status=publish --format=ids | xargs -I{} wp post get {} --field=content | grep -l 'post_cf_form'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
