CVE-2026-16610: Critical RCE in WordPress Admin & Site Enhancements Pro Plugin

Overview

A critical remote code execution (RCE) vulnerability has been disclosed in the Admin and Site Enhancements (ASE) Pro plugin for WordPress, tracked as CVE-2026-16610. The flaw carries a CVSS score of 9.8 (Critical) and affects all versions up to and including 8.9.0.

This vulnerability is particularly dangerous because it requires no authentication to exploit — an unauthenticated attacker with network access to a vulnerable WordPress installation can trigger arbitrary code execution on the server.

Technical Details

The vulnerability exists in the recursive_html function within the plugin's frontend save handler. The root cause is a flawed authorization model:

• The handler enforces only a publicly emitted nonce for validation
• There is no authentication check beyond the nonce
• No CAPTCHA validation is enforced
• Because the nonce is publicly accessible, any unauthenticated user can obtain a valid nonce and submit malicious payloads

This allows an attacker to invoke the recursive_html function with attacker-controlled input, leading to server-side code execution in the context of the web server process.

Affected Versions

Impact

Successful exploitation of CVE-2026-16610 could allow an attacker to:

• Execute arbitrary PHP code on the WordPress server
• Establish persistent backdoors or web shells
• Exfiltrate sensitive data including database credentials and user information
• Pivot to other systems on the same network or hosting environment
• Completely compromise the WordPress installation and hosted content

Given the plugin's role in site administration, a compromised ASE Pro installation provides an attacker with deep access to WordPress settings, user management, and content.

Remediation

1. Update immediately to a patched version of the ASE Pro plugin (versions > 8.9.0 if available from the developer)
2. Disable the plugin if an update is not yet available and assess exposure
3. Review server logs for signs of exploitation (unexpected POST requests to frontend save endpoints)
4. Audit user accounts and administrator access for unauthorized changes
5. Consider a Web Application Firewall (WAF) rule to block exploitation attempts against this endpoint while patching is underway

Detection

Security teams should monitor for:

• Unusual POST requests to WordPress frontend endpoints with nonce parameters
• Unexpected file creation or modification in the WordPress document root
• PHP process spawning unusual child processes
• Network connections originating from the web server process

References

• NVD — CVE-2026-16610
• CVSS 3.1 Score: 9.8 (Critical)