CVE-2026-16610
The Admin and Site Enhancements (ASE) Pro plugin for WordPress contains a critical flaw that lets anyone run arbitrary code on the server. The vulnerability lies in the recursive_html function, which is triggered by the [post_cf_form] shortcode. Attackers can exploit it without needing to log in or provide any user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites that use the ASE Pro plugin, versions up to and including 8.9.0.
Real-world impact
An attacker can execute any code on the affected server, potentially taking full control of the site, stealing sensitive data, or installing malware. This could lead to data loss, site defacement, or further compromise of the hosting environment.
Why this severity
The CVSS score of 9.8 reflects a critical vulnerability. The vector indicates it can be exploited over the network (AV:N), requires no authentication (PR:N), and needs no user interaction (UI:N). It can compromise confidentiality, integrity, and availability of the affected system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources