WordPress Click2Shell flaw lets hackers execute PHP on the server
WordPress Core vulnerability allows unauthenticated attackers to execute PHP code.
A critical CSRF vulnerability dubbed 'Click2Shell' in WordPress Core allows unauthenticated attackers to execute arbitrary PHP code on a server. The flaw, discovered by Paulos Yibelo, enables attackers to install any theme from the WordPress.org catalog and run malicious PHP files, potentially leading to data theft, file modification, or the creation of rogue admin accounts. While an administrator must visit a crafted URL for the exploit to trigger, the vulnerability has been patched in WordPress version 7.1.1.
AI summary of the linked source. Not reviewed by an editor. How this works
Run pwn.ai?
Get an email when a new story names pwn.ai, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Click2Shell vulnerability exploits a Cross-Site Request Forgery (CSRF) weakness in WordPress Core, allowing attackers to execute arbitrary PHP code simply by luring an authenticated administrator to visit a malicious URL. The root cause is insufficient CSRF protection on sensitive administrative actions — specifically theme installation — which can be weaponized without any credentials. This matters because a successful exploit can lead to full server compromise, including data theft, unauthorized admin account creation, and persistent backdoors. The reliance on a single human action (an admin clicking a link) makes social engineering a viable and dangerous attack vector, underscoring why both technical controls and user awareness are essential.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.