CVE-2026-16610 is a critical remote code execution vulnerability in the Admin and Site Enhancements (ASE) Pro WordPress plugin affecting all versions up to and including 8.9.0. The vulnerability arises because the frontend save handler relies solely on a publicly emitted nonce without proper authentication checks. CAPTCHA validation can be bypassed by omitting an attacker-supplied key. Additionally, repeater row keys from cfgroup[input] are stored verbatim and later passed into an eval() call within the recursive_html function without any sanitization or validation. This allows unauthenticated attackers to execute arbitrary code on the server if the [post_cf_form] shortcode is present on a publicly accessible page, as it exposes the nonce and session ID needed to reach the vulnerable save handler.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server hosting the vulnerable ASE Pro plugin. This can lead to full compromise of the WordPress site, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 9.8, reflecting critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or disable the use of the [post_cf_form] shortcode on publicly accessible pages to prevent exposure of the nonce and session ID. Monitor for plugin updates from the vendor and apply official patches promptly once available.