Admin and Site Enhancements (ASE) Pro <= 8.9.0 Unauthenticated RCE via PHP Injection (CVE-2026-16610)

Vulnerability Overview Vulnerability Name: Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key CVE ID: CVE-2026-16610 CVSS Score: 9.8 (Critical) Publication Date: July 29, 2026 Last Updated: July 30, 2026 Researcher: Nox Axter Affected Scope Affected Versions: <= 8.9.0 Fixed Version: 8.9.1 Remediation Remediation Steps: Update to version 8.9.1 or later patched versions Vulnerability Description The Admin and Site Enhancements (ASE) Pro plugin contains a remote code execution vulnerability affecting all versions. The vulnerability arises because the frontend save handler only performs authentication checks using a publicly issued nonce. CAPTCHA verification can be bypassed by omitting the attacker-provided key and the repeater row key stored in . These keys are stored without sanitization or identifier validation and are later used in calls. This allows an unauthenticated attacker to execute code on the server. This requires the shortcode to exist on at least one publicly accessible page, as the nonce and session ID must reach the save handler for the vulnerability to be triggered by unauthenticated visitors. References Learn more about Arbitrary File Upload vulnerabilities and how to prevent them Additional Information Software Type: Plugin Software Name: Admin and Site Enhancements (ASE) Pro Software Version: <= 8.9.0 Patched: Yes Fixed Version: 8.9.1 Recent Vulnerabilities 1. Admin and Site Enhancements (ASE) Pro <= 8.8.5 - Unauthenticated Stored Cross-Site Scripting - CVE ID: CVE-2026-57625 - CVSS Score: 7.2 - Researcher: Nguyen Ba Khanh - Publication Date: June 29, 2026 2. Admin and Site Enhancements (ASE) Pro <= 8.8.3 - Missing Authorization - CVE ID: CVE-2026-12083 - CVSS Score: 5.3 - Researcher: Revanth Hari Narayana Matte - Publication Date: June 26, 2026 3. Admin and Site Enhancements (ASE) Pro <= 7.6.2.1 - Authenticated (Subscriber+) Privilege Escalation - CVE ID: CVE-2024-43333 - CVSS Score: 7.5 - Researcher: Rafie Muhammad - Publication Date: February 3, 2025 4. Admin and Site Enhancements (ASE) Pro <= 7.6.1.1 - Missing Authorization - CVE ID: CVE-2025-24653 - CVSS Score: 4.3 - Researcher: Rafie Muhammad - Publication Date: January 24, 2025 Summary The Admin and Site Enhancements (ASE) Pro plugin contains a critical remote code execution vulnerability affecting all versions <= 8.9.0. Users are advised to update to version 8.9.1 or later immediately to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Admin and Site Enhancements (ASE) Pro <= 8.9.0 Unauthenticated RCE via PHP Injection (CVE-2026-16610)