WordPress Click2Shell flaw lets hackers execute PHP on the server
-
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed Click2Shell, which affects the platform's Core component.
The flaw allows an attacker to execute PHP on the server by tricking a logged-in user into clicking a crafted link or page element, exploiting the lack of proper request validation in the affected Core functionality. Because the issue resides in WordPress Core itself rather than a plugin or theme, the exposure is broad across installations that have not yet been patched.
Key points to be aware of:
- The vulnerability is a CSRF issue, meaning exploitation depends on luring an authenticated user into performing an unintended action.
- A working proof-of-concept exploit has been publicly released, lowering the barrier for attackers.
- Successful exploitation can result in PHP execution on the server, a serious outcome that can lead to full site compromise.
- The weakness is in WordPress Core, so plugin-level or theme-level mitigations alone are not sufficient.
Administrators should prioritize updating WordPress to a patched release as soon as one is available, and should review their environments for signs of unexpected file changes or unauthorized code execution. Until a fix is applied, limiting exposure of administrative interfaces and enforcing strong session hygiene can reduce the practical risk of a click-based attack.
Source: BleepingComputer
Has your organization already applied mitigations for this Core CSRF issue, or are you still waiting on a patch?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login