A serious security vulnerability has been identified in the Admin and Site Enhancements (ASE) Pro plugin for WordPress. All versions of this plugin up to and including version 8.9.0 are affected by a remote code execution flaw, a high-severity issue that allows unauthorized parties to run commands on your website’s server.
This flaw can be exploited by unauthenticated attackers, meaning people who do not have login access to your WordPress admin area. If successfully exploited, attackers could alter your site’s content, steal data stored on your site, or cause other harmful disruptions to your site’s normal operation.
For this attack to work, the [post_cf_form] shortcode must be present on at least one page that is publicly accessible to all visitors. The vulnerability exists because the plugin’s save handler lacks proper authentication checks, and unsanitized user input is passed directly into a code execution function without validation.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-16610