WordPress ASE Pro Plugin Unauthenticated RCE via recursive_html Eval Injection

Technical Analysis

CVE-2026-16610 (CVSS 9.8) arises from the recursive_html function in ASE Pro, where attacker-controlled input from cfgroup[input] repeater row keys is stored without sanitization or identifier validation and later passed directly into an eval() call. The frontend save handler only checks a publicly emitted nonce with no authentication requirement, and CAPTCHA protection can be bypassed by simply omitting the attacker-supplied key. Exploitation requires the [post_cf_form] shortcode to be rendered on a publicly accessible page, since this shortcode leaks the nonce and session ID needed to reach the vulnerable handler to any unauthenticated visitor. Successful exploitation grants full server-side code execution, enabling webshell deployment, data exfiltration, or lateral movement within the hosting environment. Organizations running AI agents or automation pipelines that manage WordPress content, scrape or ingest data from affected sites, or host agent-facing web interfaces on compromised servers could have API keys, credentials, or RAG data stores exposed if co-located with a vulnerable WordPress instance, warranting inclusion as agent-relevant infrastructure risk.

Affected Systems

WordPress sites running the Admin and Site Enhancements (ASE) Pro plugin, all versions up to and including 8.9.0, specifically those using the [post_cf_form] shortcode on publicly accessible pages.

Indicators of Compromise

• No specific IOCs published at this time; monitor for anomalous POST requests to WordPress admin-ajax.php or frontend save handlers referencing cfgroup[input] parameters, unexpected eval() execution artifacts in PHP error logs, and unauthorized file writes in wp-content directories.

Remediation Steps

1. 1

   Update ASE Pro Plugin

   Upgrade to the latest patched version of Admin and Site Enhancements Pro beyond 8.9.0 as soon as it becomes available from the vendor.

2. 2

   Disable or Restrict post_cf_form Shortcode

   Temporarily remove or restrict public access to pages using the [post_cf_form] shortcode until a patch is applied.

3. 3

   Web Application Firewall Rules

   Deploy WAF rules to detect and block suspicious cfgroup[input] payloads and eval-like injection patterns targeting the plugin's save handler.

4. 4

   Audit and Monitor Server Logs

   Review web server and PHP logs for unauthorized code execution attempts, unusual admin-ajax.php calls, or newly created/modified files.

5. 5

   Isolate Hosting Environment

   Ensure WordPress hosting is segmented from systems running AI agents, credential stores, or sensitive automation infrastructure to limit blast radius if compromised.