As cited
Copy frozen at (site build).
vulnerabilities
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
WordPress released patches for vulnerabilities in its core software, including a flaw that allows a crafted link opened by a logged-in administrator to automatically install themes from the official WordPress.org directory without explicit user action. Security researchers at pwn.ai reported the attack chain, termed Click2Shell, which can potentially chain to remote code execution.
Why it matters: WordPress administrators are at risk of unwanted theme installation that may lead to code execution if they click a malicious link while logged in; patching is urgent for all WordPress site owners and hosting providers.
- Source published
- First seen by Cybersecurity Tracker