The ASE Pro WordPress plugin contains a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code on the host server.

The plugin's frontend save handler fails to perform authentication or CAPTCHA validation, allowing unauthenticated attackers to submit malicious inputs. These inputs are processed via a recursive function and spliced into an eval call, facilitating arbitrary code execution on the server.

A CVSS score of 9.8 reflects the severity of this vulnerability, which allows full server compromise. An attacker could leverage this access to exfiltrate sensitive site data, install backdoors, or use the compromised WordPress site as a platform for further attacks, resulting in total loss of site integrity and potential legal liabilities.

Immediate Action: Update the Admin and Site Enhancements (ASE) Pro plugin to the latest available version immediately.

Proactive Monitoring: Monitor server logs for unusual file modifications, unexpected PHP execution errors, or suspicious requests directed at pages containing the [post_cf_form] shortcode.

Compensating Controls: Use a Web Application Firewall (WAF) with updated rules to detect and block malicious payloads targeting the vulnerable save handler, and temporarily disable the [post_cf_form] shortcode if an immediate update is not possible.

Public Exploit Available: Unknown.

All administrators using the ASE Pro plugin must apply the vendor-provided security update immediately. Given the high risk of remote code execution and the potential for full site takeover, delaying remediation is not recommended.