[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGBQcf3vw89-QsMDhLmbz3N9aWzu-qWH5mCKT-7bpKaQ":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"0ee7dee0-53a7-4291-9b93-00037113093e","WordPress Click2Shell flaw lets hackers execute PHP on the server","wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server-7c13e8","Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component. [...]","A critical CSRF vulnerability dubbed 'Click2Shell' in WordPress Core allows unauthenticated attackers to execute arbitrary PHP code on a server. The flaw, discovered by Paulos Yibelo, enables attackers to install any theme from the WordPress.org catalog and run malicious PHP files, potentially leading to data theft, file modification, or the creation of rogue admin accounts. While an administrator must visit a crafted URL for the exploit to trigger, the vulnerability has been patched in WordPress version 7.1.1.","WordPress Core vulnerability allows unauthenticated attackers to execute PHP code.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fwordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F15\u002FWordPress.jpg","2026-09-21T18:23:11+00:00","2026-09-21T20:00:28.250599+00:00",8,[17,20,22,24,27],{"name":18,"type":19},"WordPress Core","product",{"name":21,"type":19},"WordPress.org Themes API",{"name":23,"type":19},"Customizer",{"name":25,"type":26},"pwn.ai","vendor",{"name":28,"type":19},"WordPress","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,37,42],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[25,18,21],{"controls":50,"vendors":133},[51,80,106],{"slug":52,"name":53,"problem":54,"products":55},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":81,"name":82,"problem":83,"products":84},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[85,93,98],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":94,"product_name":95,"url":96,"description":97},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":107,"name":108,"problem":109,"products":110},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[111,118,126],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":107,"product_name":115,"url":116,"description":117},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":130,"url":131,"description":132},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":150},"wordpress-csrf-flaw-enables-remote-php-execution-via-admin-trick","WordPress CSRF Flaw Enables Remote PHP Execution via Admin Trick","The Click2Shell vulnerability exploits a Cross-Site Request Forgery (CSRF) weakness in WordPress Core, allowing attackers to execute arbitrary PHP code simply by luring an authenticated administrator to visit a malicious URL. The root cause is insufficient CSRF protection on sensitive administrative actions — specifically theme installation — which can be weaponized without any credentials. This matters because a successful exploit can lead to full server compromise, including data theft, unauthorized admin account creation, and persistent backdoors. The reliance on a single human action (an admin clicking a link) makes social engineering a viable and dangerous attack vector, underscoring why both technical controls and user awareness are essential.",[139,140,141,142,143,144,145,146,147,148,149],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-23: Session Authenticity (CSRF Protection)","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-12: Audit Record Generation","OWASP Top 10 A05:2021 – Security Misconfiguration","OWASP Top 10 A01:2021 – Broken Access Control","GDPR Article 32: Security of Processing (breach prevention obligations)","ITIL Change Management: Emergency Change procedures for critical patches",{}]