WordPress core (Product): news timeline & CVEs

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

A crafted comment (Comment2Shell) allowed an attacker to run code on the server via a line break in an HTML attribute. Another flaw, Click2Shell, enabled theme installation and further code execution. WordPress has had…

Two separate security flaws: Comment2Shell allowing code execution via comments and Click2Shell enabling theme installation. These were patched in the latest WordPress releases and are considered exploitable issues.

The Hacker Newsupdated Sep 25, 12:16 UTC · 1d agofirst Sep 22, 06:03 UTC · 5d agoExploit / PoC in the wild 6 sources CVE-2026-93485

Click2Shell WordPress Flaw Lets Attackers Gain RCE With a Single Malicious Link

Researchers disclosed Click2Shell, a WordPress exploit chain that turns a single malicious link clicked by an admin into remote code execution; fixed in WordPress 7.1.1.

Researchers Paulos Yibelo and pwn.ai disclosed Click2Shell, chaining a WordPress Core theme-installer selector injection with an insecure AJAX handler in the Mobile Repair Zone 2.5.4 theme to achieve remote code execution. The Core flaw lets a crafted URL force-install an inactive WordPress.org theme with no attacker account, leveraging a logged-in administrator's session and nonce. WordPress fixed the selector injection in version 7.1.1 (September 17, 2026) via changeset 63664, in a release containing 11 security fixes. The standalone forced-install flaw is rated CVSS 3.1 7.1 while the full RCE chain is considered critical, and no in-the-wild exploitation or CVE identifier has been reported.

Cyber Security NewsSep 19, 04:30 UTC · 8d agoVulnerability1

WordPress core

Timeline2 articles

Related CVEsby mentions

Appears with

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

Click2Shell WordPress Flaw Lets Attackers Gain RCE With a Single Malicious Link