importantSYS.SOURCE: The Hacker News• 2026-09-18T22:26:19+05:30

WordPress Click2Shell Vulnerability Enables Forced Theme Installation and Potential Code Execution

#wordpress #vulnerability #code-execution #security-patch #web-security

A newly discovered WordPress vulnerability, dubbed Click2Shell, allows attackers to force theme installations without user interaction by exploiting a crafted URL. When combined with a separate theme vulnerability, it enables code execution on the server, though no active exploitation has been reported.

WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install.

The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell. On its own the flaw only

Read original article

*** END OF TRANSMISSION ***

> ANDROID 17 QPR1 INTRODUCES NEW APIS EXCLUSIVELY FOR PIXEL OS WITHOUT AOSP RELEASE > LINGUISTIC ILLEGIBILITY IN LARGE LANGUAGE MODELS: IMPLICATIONS FOR SECURITY > DIRECT SEMANTIC COMMUNICATION BETWEEN LARGE LANGUAGE MODELS VIA CACHE-TO-CACHE MECHANISM > OPTIMIZING MEMORY USAGE WITH MATHEMATICAL TECHNIQUES AND RUST PROGRAMMING > TYPESAFE AI'S JEV MODEL OFFERS CALIBRATED DECISIONS FOR SOFTWARE AUTOMATION > APPLE UNVEILS IPHONE DUO SIMULATOR AND XCODE 27.1 BETA FOR DEVELOPERS > U.S. BORDER AGENTS PERMITTED TO SEARCH CELLPHONES WITHOUT WARRANT OR SUSPICION > DISNEY'S FIRST CTO JOINS AI STARTUP PREVIOUSLY ACCUSED OF IP INFRINGEMENT > QUICK-COMMERCE PLATFORMS DELIVER NEW IPHONES IN MINUTES IN INDIA > GOOGLE INTRODUCES FAMILY-FOCUSED AI AGENT CC FOR HOUSEHOLD COORDINATION> ANDROID 17 QPR1 INTRODUCES NEW APIS EXCLUSIVELY FOR PIXEL OS WITHOUT AOSP RELEASE > LINGUISTIC ILLEGIBILITY IN LARGE LANGUAGE MODELS: IMPLICATIONS FOR SECURITY > DIRECT SEMANTIC COMMUNICATION BETWEEN LARGE LANGUAGE MODELS VIA CACHE-TO-CACHE MECHANISM > OPTIMIZING MEMORY USAGE WITH MATHEMATICAL TECHNIQUES AND RUST PROGRAMMING > TYPESAFE AI'S JEV MODEL OFFERS CALIBRATED DECISIONS FOR SOFTWARE AUTOMATION > APPLE UNVEILS IPHONE DUO SIMULATOR AND XCODE 27.1 BETA FOR DEVELOPERS > U.S. BORDER AGENTS PERMITTED TO SEARCH CELLPHONES WITHOUT WARRANT OR SUSPICION > DISNEY'S FIRST CTO JOINS AI STARTUP PREVIOUSLY ACCUSED OF IP INFRINGEMENT > QUICK-COMMERCE PLATFORMS DELIVER NEW IPHONES IN MINUTES IN INDIA > GOOGLE INTRODUCES FAMILY-FOCUSED AI AGENT CC FOR HOUSEHOLD COORDINATION