Technical details and a proof-of-concept exploit have been published for a WordPress vulnerability dubbed Click2Shell. The flaw is a cross-site request forgery (CSRF) issue in the platform's Core component, according to BleepingComputer.
Using the vulnerability, attackers can execute PHP on the server. Because the proof-of-concept is now public, the report highlights a concrete exploitation route for what is otherwise a server-side code execution risk.
The report does not mention a patch or official response from WordPress. With the flaw residing in Core, the potential impact is broad, though the source does not provide details on affected versions or mitigation steps.