CVE-2026-16610

The Admin and Site Enhancements Pro plugin for WordPress contains a security flaw in versions up to 8.9.0 that allows an attacker without authentication to inject malicious code on the server. This vulnerability arises from a combination of factors, including the frontend save handler's reliance on a publicly available nonce with no verification check, the bypassability of CAPTCHA validation by omitting a required key, and the storage of unsanitized repeater row keys in eval() calls within the recursive_html function.

Based on public CVE data (MITRE/NVD).