The flaw allows an attacker to execute PHP on the server by tricking a logged-in user into clicking a crafted link or page element, exploiting the lack of proper request validation in the affected Core functionality. Because the issue resides in WordPress Core itself rather than a plugin or theme, the exposure is broad across installations that have not yet been patched.

Key points to be aware of:

• The vulnerability is a CSRF issue, meaning exploitation depends on luring an authenticated user into performing an unintended action.
• A working proof-of-concept exploit has been publicly released, lowering the barrier for attackers.
• Successful exploitation can result in PHP execution on the server, a serious outcome that can lead to full site compromise.
• The weakness is in WordPress Core, so plugin-level or theme-level mitigations alone are not sufficient.

Administrators should prioritize updating WordPress to a patched release as soon as one is available, and should review their environments for signs of unexpected file changes or unauthorized code execution. Until a fix is applied, limiting exposure of administrative interfaces and enforcing strong session hygiene can reduce the practical risk of a click-based attack.

Source: BleepingComputer

Has your organization already applied mitigations for this Core CSRF issue, or are you still waiting on a patch?