CVE-2026-16610

Name of the Vulnerable Software and Affected Versions Admin and Site Enhancements (ASE) Pro versions prior to 8.9.1

Description Unauthenticated attackers can achieve Remote Code Execution on the server through the recursive html() function. The issue occurs because the frontend save handler only requires a publicly emitted nonce and lacks authentication checks. Additionally, CAPTCHA validation can be bypassed by omitting an attacker-supplied key. Repeater row keys from the cfgroup[input] parameter are stored without sanitization and subsequently passed into an eval() call. This exploitation requires the [post cf form] shortcode to be active on a publicly accessible page, as it exposes the necessary nonce and session ID to visitors.

Recommendations Update to a version newer than 8.9.0. As a temporary mitigation, remove the [post cf form] shortcode from all publicly accessible pages to prevent unauthenticated access to the save handler.