WordPress has issued patches for a set of core vulnerabilities, including one that security researchers have named Click2Shell. The flaw involves a crafted web link that, when opened by a logged-in administrator, can trigger the installation of a theme from the official WordPress.org directory without the user explicitly clicking the install button.
The attack chain matters because installing a theme is not the end goal. According to The Hacker News, the vulnerability can be chained to achieve code execution, meaning an attacker could potentially move from a single malicious link to running arbitrary code on the affected site.
The patch is part of WordPress's latest core update. Administrators are advised to update promptly, as the attack requires only that an admin open a link while logged in. The report does not mention active exploitation of the flaw.