External risk intelligence

Admin and Site Enhancements Pro Plugin Unauthenticated Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16610

The vulnerability exists in a WordPress plugin that is triggered by a shortcode placed on public-facing web pages. Because it is reachable by unauthenticated visitors on the public internet to execute code, it fits the criteria for a service that is public-facing by design.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Admin and Site Enhancements Pro WordPress plugin that could allow unauthenticated attackers to execute arbitrary code on your server. This issue arises from how the plugin handles user input, specifically within its `recursive_html` function, where data is processed without proper sanitization and directly used in an `eval()` call, potentially leading to server-side code execution. The vulnerability requires a specific shortcode to be present on a public page to be exploitable, but once present, it could be leveraged by an attacker with network access.

Unauthenticated attackers can run code on servers.
Critical flaw in a widely used plugin, if exposed.
Confirm relevance; assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can execute arbitrary code on the server by exploiting a vulnerability in the Admin and Site Enhancements Pro WordPress plugin. This is possible when a specific shortcode is present on a public page, which exposes a save handler that lacks proper authentication and validation. The attacker can then bypass security checks and send specially crafted input, leading to the execution of malicious code.

Publicly accessible page with shortcode.
Unauthenticated save handler with bypassable CAPTCHA.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could execute arbitrary code on the server when the `[post_cf_form]` shortcode is present on a publicly accessible page. This allows for the compromise of the WordPress installation and the underlying server when the frontend save handler's nonce and session ID are exposed.

WordPress server code execution.
Via a public shortcode and weak authentication.
Complete compromise of the WordPress site.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Admin and Site Enhancements Pro plugin impacts all WordPress sites using versions up to 8.9.0, provided the `[post_cf_form]` shortcode is present on a public page. Given the WordPress context, application owners or platform teams are likely responsible for managing plugins. The immediate first step is to identify all instances of the affected plugin, confirm if the shortcode is active on public pages, and then prioritize remediation based on exposure and business criticality.

Application owners are responsible for remediation.
Verify plugin presence and shortcode usage.
Plan remediation based on business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Admin and Site Enhancements (ASE) Pro plugin?

ASE Pro is a WordPress plugin used to add functional tools and site management features. It is typically installed by site administrators to simplify complex site configurations, extending the default capabilities of the WordPress platform.

What does CWE-434 mean for CVE-2026-16610?

This CVE involves a weakness where the plugin takes user-provided data and processes it using an eval() function without checking or cleaning it first. Essentially, the code incorrectly treats incoming web traffic as instructions to be executed directly by the server, allowing an attacker to run their own commands.

How does an attacker trigger this vulnerability?

An attacker needs the site to have the [post_cf_form] shortcode displayed on a public page. This shortcode emits the necessary security tokens to reach the vulnerable handler. If the shortcode is not present on any public-facing page, the specific path used to reach the vulnerable code is not available to an attacker.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal identifies this as high risk because the vulnerability exists in a feature meant for public interaction. Since the [post_cf_form] shortcode is designed to be placed on public web pages, any site using this plugin effectively exposes the vulnerable handler to the internet by design.

Do I need to take action if I use ASE Pro?

Yes. First, audit your WordPress installation to see if the Admin and Site Enhancements Pro plugin is active. Check your pages to determine if the [post_cf_form] shortcode is in use. If you are using version 8.9.0 or earlier, prioritize verifying your exposure and prepare to update or disable the plugin to prevent unauthorized code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.