CVE-2026-16610 is a critical remote code execution vulnerability in the ASE Pro WordPress plugin versions up to and including 8.9.0. The flaw arises because the frontend save handler relies solely on a publicly emitted nonce without proper authentication checks. CAPTCHA validation can be bypassed by omitting a supplied key. Additionally, repeater row keys from cfgroup[input] are stored verbatim and later passed into an eval() call within the recursive_html function without sanitization or validation. This allows unauthenticated attackers to execute arbitrary code on the server if the [post_cf_form] shortcode is present on a publicly accessible page, as it exposes the necessary nonce and session ID to unauthenticated visitors.

Successful exploitation results in unauthenticated remote code execution on the server hosting the ASE Pro plugin, leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should remove or disable the [post_cf_form] shortcode on public pages to prevent exposure of the vulnerable save handler. Avoid using vulnerable versions (<=8.9.0) of ASE Pro. Monitor vendor communications for patches or official mitigations.