The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to unauthenticated Remote Code Execution in all versions up to and including 8.9.0. The vulnerability exists in the recursive_html function, where the frontend save handler uses only a publicly emitted nonce with no authentication check. CAPTCHA validation can be bypassed by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later injected into an eval() call without sanitization. This allows unauthenticated attackers to execute arbitrary code on the server. Exploitation requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID are emitted to unauthenticated visitors. The combination of missing authentication, bypassable CAPTCHA, and unsanitized eval() input makes this a critical severity vulnerability.