WordPress Click2Shell flaw lets hackers execute PHP on the server

Reported by BleepingComputer (Bill Toulas)

Summary by Cyber Security News21 Sep 2026, 20:23 CEST

About this summary. This is a short, independently written summary of an article first published by BleepingComputer. Cyber Security News did not report or verify the underlying story. Read the original: https://www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/

WordPress Click2Shell flaw lets hackers execute PHP on the server — Image: BleepingComputer

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component.

Read the full article at BleepingComputer →

Exploit

Source attribution: headline and facts are from BleepingComputer (bleepingcomputer.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

USN-8794-1: GLib vulnerabilities

Click2Shell: WordPress Flaw Enables RCE Chain

Clop Hack: ShinyHunters Hijacks Data Leak Site

Clop gets a taste of its own medicine after ShinyHunters hijack leak site

Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities

Serverless, Not Riskless: Exploiting Unauthenticated API Gateways in AWS