CYBER● ELEVATEDSep 18 · Sep 18, 2026, 4:56 PM
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
The Hacker News · global
WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell. On its own the flaw only
GlobeAlert aggregates and classifies open sources; the story above belongs to its publisher. Summaries are machine-generated from the source text.
More in Cyber
CYBERnow[Virtual Event] Cybersecurity Outlook 2027Dark ReadingCYBERnow[Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AIDark ReadingCYBER50m agoRussia and China are using AI to stage relentless cyberattacks against the UKNew ScientistCYBER1h ago‘Witch hunt’ sweeps up Asian men misidentified in alleged Cornell gang rapeSouth China Morning Post