WordPress fixes Click2Shell flaw as proof-of-concept code becomes public

Image: Primary

Published Monday, September 21, 2026 · 11:10 PM EDT

Technical details and proof-of-concept code were published for Click2Shell, a WordPress Core vulnerability fixed in version 7.1.1. The attack chain can make a logged-in administrator's browser install a vulnerable catalog theme and execute its PHP code on the server, even though the attacker needs no WordPress account. Successful exploitation could expose user data and configuration secrets, modify files or create rogue administrators. The flaw affects WordPress Core 7.1.0 and earlier, but the administrator must visit a crafted link and lower-privileged Author or Editor accounts cannot trigger the chain.

Sources

BleepingComputer github.com

Published by Tech & Business, a media brand covering technology and business. This story was sourced from BleepingComputer, github.com and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Science Security

Preprint links restricted AI access to increased vulnerability disclosures

A preprint studying Project Glasswing finds that firms given early access to Claude Mythos Preview more than doubled vulnerability disclosures relative to Chinese and Russian tech firms without access.

Security

Researchers demonstrate Android crash loop triggered by app installation

Bitdefender researchers demonstrated an Android flaw called GhostMap that lets an installed app trigger a persistent crash loop without requesting permissions or being launched, BleepingComputer reported.

Security

OpenSSH releases workaround for critical flaw affecting some Alpine Linux systems

OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability affecting Linux systems that use musl libc with PAM disabled, LWN reported.

Security

IonQ agrees to acquire Elisity for quantum security platform

IonQ agreed to acquire security specialist Elisity to integrate identity-based access controls into its quantum security platform, Yahoo Finance reported.

Security Capital

Palo Alto Networks in talks to buy Clutch Security for around $500 million

Palo Alto Networks is in talks to acquire Clutch Security for around $500 million, The Information reported, citing people familiar with the matter. The three-year-old Israeli security startup develops software that tracks passwords used by AI agents.

Security Products

Binance traces theft to engineer compromised in fake job interview

Binance says attackers used a fake job interview to compromise an engineer's computer and move through employee systems before last week's cryptocurrency theft. Its latest account says $6.34 billion in digital assets were affected, with $2.85 billion frozen or intercepted.