WordPress Click2Shell flaw lets hackers execute PHP on the server

A new cross-site request forgery (CSRF) vulnerability nicknamed 'Click2Shell' has been disclosed affecting WordPress Core. Technical details and a proof-of-concept exploit have been published, raising the risk of active exploitation. The flaw allows attackers to trick authenticated users into triggering malicious requests, ultimately enabling remote PHP code execution on the server. As it affects WordPress Core rather than a specific plugin or theme, the attack surface is extremely broad. The availability of a public PoC significantly increases the likelihood of exploitation in the wild. WordPress site administrators are advised to apply patches or mitigations as soon as they become available.