WordPress Click2Shell flaw lets hackers execute PHP on the server

Technical details and a proof-of-concept exploit have been released for a severe cross-site request forgery vulnerability affecting the WordPress core, dubbed Click2Shell. This flaw allows threat actors to execute arbitrary PHP code on vulnerable servers by tricking site administrators. Administrators should monitor for official patches and update their WordPress installations immediately to prevent potential remote code execution attacks.