CYBER● ELEVATEDSep 18 · Sep 18, 2026, 4:56 PM
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
The Hacker News · global
WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell. On its own the flaw only
GlobeAlert aggregates and classifies open sources; the story above belongs to its publisher. Summaries are machine-generated from the source text.
More in Cyber
CYBERnow[Virtual Event] Cybersecurity Outlook 2027Dark ReadingCYBERnow[Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AIDark ReadingCYBER41m agoEU Grocers Pay a Steep Price for Unpatched Fridge FirmwareDark ReadingCYBER1h agoPalo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active ExploitationThe Hacker News