WordPress Core Cross-Site Request Forgery Vulnerability Dubbed 'Click2Shell' Enables PHP Execution

A cross-site request forgery (CSRF) vulnerability in WordPress Core, identified by the handle 'Click2Shell', has been reported to allow attackers to execute arbitrary PHP code on the server. According to a report from BleepingComputer, technical details and a proof-of-concept exploit have been published for the vulnerability affecting WordPress Core. The report indicates that the CSRF vulnerability could allow attackers to execute arbitrary PHP code on the server, potentially leading to full system compromise, data exfiltration, or site takeover. The publication notes that exploitation of the vulnerability requires user interaction to trigger a malicious request. As of the report date, no official patch has been mentioned, and the full extent of affected WordPress versions, exploitation activity in the wild, and severity rating remain unconfirmed. WordPress users are advised to monitor official WordPress security releases and apply updates as they become available. Implementing CSRF tokens and input validation is recommended as a mitigation measure. The report was published by BleepingComputer on September 21, 2026. Verification of the vulnerability's scope, severity, and active exploitation status through official WordPress security advisories is advised.