Published on 1 August 2026
An attacker needs no username, no password and no stolen credentials. A single publicly reachable page with a particular form is enough – and they can already execute arbitrary program code on your server. This is not a theoretical threat but the real-world consequence of CVE-2026-16610, a critical security vulnerability in the popular WordPress plugin Admin and Site Enhancements (ASE) Pro. The flaw was officially published on 30 July 2026 and carries the highest possible severity range: a CVSS score of 9.8 out of 10 ("Critical").
Anyone running the Pro version of this plugin in version 8.9.0 or older should not leave this article for tomorrow. In plain language, we explain what happened, whether you are affected and – above all – what you need to do right now.
On 30 July 2026, the security vulnerability CVE-2026-16610 in the WordPress plugin "Admin and Site Enhancements (ASE) Pro" was made public – reported among others via the NVD (the US National Vulnerability Database), a GitHub Security Advisory and Wordfence. Affected are all versions up to and including 8.9.0.
This is a so-called Remote Code Execution (RCE) – the execution of foreign program code from afar. It is the most dangerous class of security vulnerability there is, because it allows an attacker to control the server as if they were sitting in front of it themselves. What makes this flaw special and particularly explosive: it can be exploited unauthenticated. That means the attacker does not have to log in and needs no user account whatsoever on your website.
The vendor itself describes the bug soberly in the changelog:
"Custom Field Groups: fixed unauthenticated RCE that can occur in a scenario where a frontend post creation form contains a repeater field."
– ASE Pro Changelog
The vulnerability lies in a function named recursive_html. This function processes input from a so-called repeater field – a form element that lets users create multiple similar entries (e.g. a list) on a website.
The problem: the input coming from the parameter cfgroup[input] (the so-called "Repeater Row Keys") is passed without any check or sanitisation directly to an eval() call. eval() is a PHP function that executes a string as program code. So if you hand this function unchecked text from the internet, exactly that text is executed as a command – a classic and dangerous point of entry.
On top of this comes the second design flaw: the responsible "frontend save handler" – the routine that receives and stores the form on the public page – performs no real authentication check. It merely requires a so-called nonce (a one-time token that is actually supposed to protect forms against misuse) as well as a session ID. However, both values are output publicly on the page and are therefore readable by anyone. Even a CAPTCHA check that may be in place can, according to analyses, be bypassed.
The one prerequisite that must be met for a successful attack is clearly stated by the Ionix Threat Center:
"Exploitation requires the [post_cf_form] shortcode to be present on a publicly accessible page. Impact: Arbitrary code execution on the underlying host, leading to full compromise."
– Ionix Threat Center
In other words: as soon as the shortcode [post_cf_form] (a placeholder that embeds a form on a page) is present on at least one publicly reachable page of your website, the vulnerability can be actively exploited. The specialist firm SentinelOne sums up the consequence:
"Unauthenticated attackers can achieve full remote code execution on WordPress sites running vulnerable ASE Pro versions, leading to complete site compromise."
– SentinelOne
Affected is the Pro version of "Admin and Site Enhancements (ASE)" in all versions up to and including 8.9.0. The plugin is actively in use on over 200,000 websites. Exactly how many of those run the vulnerable Pro version with the critical shortcode cannot be quantified precisely – but the danger potentially affects a considerable share of users.
Particularly at risk are websites that allow users to create content via a frontend form (such as classified ads, entries in a directory or similar functions), since the affected shortcode [post_cf_form] is frequently used for exactly that purpose.
[post_cf_form]. Use the search function in the backend for this. If this shortcode is on a publicly reachable page, the vulnerability can be exploited directly.The good news: a patch already exists. The vendor released version 8.9.1 on 27 July 2026 – that is, even before the vulnerability was officially disclosed. Act now, in this order:
[post_cf_form] from all publicly accessible pages. Without this shortcode on a public page, the attacker lacks the point of access.Even though at this point in time (as of 1 August 2026) no active, mass exploitation is known, you should not wait. The circumstances of this vulnerability are a nightmare scenario for defenders: it is easy to exploit (low attack complexity), possible without login and requires no user interaction whatsoever.
Automated bots scour the internet around the clock for vulnerable WordPress installations. And the time windows are frighteningly short: according to Patchstack's "State of WordPress Security in 2026" report, the median time from the publication of a vulnerability to mass exploitation is just five hours. So anyone who only reacts a week later may have left a door standing open for a week.
To put the overall picture into perspective: in 2025, 11,334 new WordPress vulnerabilities were registered – an increase of 42% over the previous year. A full 91% of all WordPress vulnerabilities affect plugins, and premium plugins like ASE Pro play a considerable role in this. Your WordPress site is therefore only as secure as the weakest of its plugins.
A successful exploitation of CVE-2026-16610 gives an attacker full access to your website and your database. This database typically contains personal data – customer data, contact enquiries, comments, registrations. Such access therefore typically constitutes a breach of the protection of personal data within the meaning of the GDPR (a "data breach").
From this follows a concrete obligation: under Article 33 GDPR you must report such a data breach within 72 hours to the competent data protection supervisory authority. This deadline runs from the moment the incident becomes known to you.
Even more important is the second dimension: supervisory authorities are increasingly penalising not just the incident itself, but the very absence of appropriate technical and organisational measures under Article 32 GDPR. This expressly includes the timely application of critical security updates. The BSI (Germany's Federal Office for Information Security) puts it this way:
"Supervisory authorities sanction structural security gaps, not just the incidents resulting from them."
– BSI context
In concrete terms: if you leave a known, patched security hole open for days or weeks and a data breach occurs, the mere failure to apply the available update can be interpreted as a violation – regardless of how "sophisticated" the attack was.
CVE-2026-16610 is one of the most dangerous kinds of security vulnerability: an unauthenticated remote code execution with a maximum CVSS score of 9.8. It allows attackers the complete takeover of affected websites – without login, without user interaction, solely through the presence of a particular form on a public page.
The core message is simple: If you are running ASE Pro in version 8.9.0 or older, update to version 8.9.1 now. If you cannot update immediately, remove the shortcode [post_cf_form] from all public pages. And in both cases, check whether your website has already been compromised.
The patch already exists – so the tools to protect your website are ready. Given a median time to mass exploitation of just five hours, the decisive variable now is your speed of response. Do not wait for the first attack to act.