New Click2Shell Vulnerability Allows Remote Code Execution in WordPress
A newly discovered security flaw named Click2Shell enables attackers to execute unauthorized PHP code on WordPress servers via the platform's theme customization feature.
Click2Shell is a newly identified security vulnerability that lets attackers execute unauthorized PHP code on WordPress servers.
The flaw works through the platform's theme management and customization features. An attack starts when a user clicks a crafted link that triggers the installation of a vulnerable theme from the catalog. Even though the theme stays inactive, malicious code triggers when the WordPress Customizer preview loads. The system processes the theme's PHP during this preview stage, allowing remote code execution on the hosting environment and bypassing standard administrative barriers.
Watch out for this. You should restrict user permissions to prevent unauthorized administrative actions and ensure that you only install themes from trusted, verified sources. Monitoring Customizer activity and reviewing theme installations will help mitigate the risk of this execution path.