The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recurs…

The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to unauthenticated Remote Code Execution in all versions up to and including 8.9.0. The vulnerability exists in the recursive_html function where the frontend save handler lacks proper authentication checks and relies only on a publicly emitted nonce. CAPTCHA validation can be bypassed by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later injected into an eval() call without sanitization or identifier validation. This allows unauthenticated attackers to execute arbitrary code on the server. Exploitation requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID are emitted to unauthenticated visitors. The combination of missing authentication, bypassable CAPTCHA, and unsanitized eval() input makes this a critical severity vulnerability.