CVE-2026-16610 is a critical security vulnerability in the Admin and Site Enhancements Pro plugin for WordPress. If your organization uses this plugin on a public-facing website, an attacker may be able to take control of the server without signing in.
This issue matters to businesses of every size because WordPress websites often support customer communications, lead generation, online sales, employee resources, and public information. A compromised site can disrupt operations, expose sensitive information, damage customer trust, and create regulatory obligations.
This article explains what the vulnerability is, why it matters to your organization, how to determine whether you are affected, and what actions you should take. A technical appendix provides additional guidance for security engineers, penetration testers, and IT professionals.
CVE-2026-16610 affects the Admin and Site Enhancements Pro, or ASE Pro, WordPress plugin through version 8.9.0. The vulnerability was publicly disclosed on July 29, 2026, and entered the National Vulnerability Database on July 30, 2026. Wordfence is identified as the reporting source in the NVD record.
The vulnerability is rated critical. Tenable records a CVSS version 3.1 score of 9.8, indicating that the issue is remotely exploitable, requires no account, needs no user interaction, and can affect confidentiality, integrity, and availability.
In plain language, the flaw allows an unauthenticated internet user to send specially crafted input to a public website and potentially make the server run unauthorized code. The vulnerable versions are ASE Pro 8.9.0 and earlier. Version 8.9.1 is listed as the patched release.
If an attacker exploits this vulnerability, your website may no longer be under your organization’s control. The attacker could alter pages, redirect visitors, install malicious software, create unauthorized administrator accounts, or use the compromised server as a platform for attacks against other systems.
The potential data impact is also significant. Depending on the website’s hosting environment and connected services, an attacker may access customer submissions, employee information, application credentials, databases, backup files, or configuration data. Even when sensitive information is not stored directly in WordPress, attackers may use a compromised site to steal passwords or target administrators.
Operational disruption can include website outages, defacement, malicious advertising, search-engine warnings, blocked email delivery, and costly recovery work. A compromised website may also become a distribution point for phishing pages that impersonate your organization.
You may need to assess whether the incident triggers breach-notification, contractual, insurance, or industry-specific reporting requirements. Organizations in the United States and Canada should involve legal counsel, privacy personnel, cyber-insurance contacts, and incident-response specialists when evidence suggests exploitation.
Updating the plugin is therefore not merely a maintenance task. It is a business-continuity and risk-management action.
Regional Bank: A regional bank uses WordPress for public product pages and a customer contact form built with ASE Pro. An attacker compromises the site, replaces the loan-application page with a convincing phishing page, and collects customer credentials. The bank faces customer-notification costs, reputational damage, and an investigation into whether the site facilitated fraud.
Healthcare Provider: A mid-sized healthcare practice publishes appointment and referral forms on its website. After exploitation, malicious code captures form submissions and redirects patients to unsafe content. The provider must investigate whether personal or health-related information was exposed while keeping patient services available.
Manufacturing Company: A manufacturer relies on its website for distributor inquiries and recruiting. An attacker modifies the site and uses the server to send spam and scan other networks. Search engines flag the domain, legitimate messages are affected, and the company loses online visibility during cleanup.
Small Professional Services Firm: A small accounting or legal firm has limited internal IT support and uses a managed WordPress host. A compromised plugin becomes an entry point for unauthorized administrator accounts and persistent malware. The firm may spend more on forensic review and website restoration than it would have spent on a prompt security assessment and controlled patch process.
[post_cf_form] shortcode on at least one publicly accessible page. This condition exposes the unauthenticated workflow associated with the vulnerability.Do not wait for website defacement or suspicious activity before validating your exposure. IntegSec can perform a penetration test, review your WordPress attack surface, identify weaknesses that automated scans may miss, and help reduce cybersecurity risk across your public-facing systems. Visit IntegSec to discuss a practical assessment for your organization.
CVE-2026-16610 affects the ASE Pro frontend form-save workflow associated with the [post_cf_form] shortcode. The vulnerable recursive_html function processes repeater-row keys supplied through cfgroup[input]. Those keys are stored and later inserted into an eval() call without adequate sanitization or identifier validation.
The save handler relies on a nonce emitted to unauthenticated visitors rather than enforcing an authenticated-user requirement. Its CAPTCHA control can also be bypassed by omitting the attacker-supplied key. Consequently, an attacker can submit crafted input that reaches the vulnerable code path and causes arbitrary PHP code execution on the WordPress server. The shortcode must be present on a publicly accessible page because it exposes the nonce and session information needed to reach the handler.
The reported attack vector is network-based, with low complexity, no privileges required, and no user interaction. Tenable lists the CVSS 3.1 vector as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a score of 9.8. The NVD lists CWE-434, Unrestricted Upload of File with Dangerous Type, although the published technical description centers on unsanitized input reaching dynamic code evaluation.
Version enumeration:
wp plugin list --fields=name,version,status | grep -i admin.grep -R "post_cf_form" wp-content/.Scanner signatures:
Log and behavior indicators:
cfgroup[input] parameters, or requests containing unexpected repeater-row keys..htaccess or server configuration.[post_cf_form] shortcode from publicly accessible pages and deactivate ASE Pro where operationally feasible. Apply web-application firewall rules that restrict the affected frontend save route and reject anomalous cfgroup[input] values. These controls reduce exposure but should be treated as temporary safeguards.eval() patterns with allowlisted data structures and fixed program logic.