Executive brief
The Admin and Site Enhancements (ASE) Pro plugin for WordPress, which provides a suite of tools for site management and custom content, contains a critical security flaw. This vulnerability allows an unauthenticated attacker to remotely execute malicious code on the server hosting the website. Such an attack could lead to a complete takeover of the site, theft of sensitive customer data, or a total service outage.
Technical details
The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution (RCE) in versions up to and including 8.9.0. The flaw exists within the 'recursive_html' function due to improper sanitization of repeater row keys from 'cfgroup[input]'. These keys are stored verbatim and subsequently spliced into an 'eval()' call. The attack is facilitated by a frontend save handler that lacks authentication checks and relies on a publicly emitted nonce. Additionally, CAPTCHA validation can be bypassed by omitting the attacker-supplied key. Exploitation requires the '[post_cf_form]' shortcode to be present on a publicly accessible page to leak the necessary nonce and session ID.
Affected products
- ASE Admin and Site Enhancements (ASE) Pro up to, and including, 8.9.0
Timeline
- 2026-07-30: disclosed: CVE published to the NVD dataset