'Click2Shell' CSRF Flaw in WordPress Core: PoC Published for Chained RCE Path

What Happened

BleepingComputer reports that technical details and a proof-of-concept exploit have been published for a new WordPress vulnerability dubbed "Click2Shell," a cross-site request forgery (CSRF) flaw affecting WordPress Core. According to the report, the flaw can be leveraged by an attacker to get PHP code executed on the server. No CVE identifier, affected version range, or vendor patch status was included in the available reporting at this time.

Why It Matters

WordPress powers a large share of the public web, and Core-level vulnerabilities have broad blast radius by default. A CSRF-driven path to PHP execution is notable because it doesn't require the attacker to have valid credentials — it relies on tricking an authenticated user (potentially an administrator) into performing an unwanted action, such as visiting a malicious page or clicking a crafted link, while logged into the WordPress admin. If the underlying claim holds up, sites running the affected, unpatched configuration could be at risk of full server compromise via webshell deployment.

What Defenders Should Watch For

• Monitor WordPress admin and plugin/theme editor endpoints for unexpected file writes, particularly new or modified .php files in wp-content/, wp-content/uploads/, or theme/plugin directories.
• Review web server and WAF logs for anomalous POST requests to WordPress Core admin-ajax or admin-post endpoints originating from unusual referrers, especially those lacking expected nonce/CSRF token values.
• Audit outbound admin sessions and browser hygiene for site administrators — CSRF requires an authenticated session, so reducing standing admin logins and using separate browser profiles for WordPress administration reduces exposure.
• Ensure WordPress Core, themes, and plugins are set to auto-update or are patched promptly once an official fix is confirmed and released.
• Consider requiring re-authentication or additional verification for sensitive Core actions (file edits, plugin/theme installs) where supported.

Because concrete technical indicators (affected versions, exploit request patterns, CVE ID) are not yet confirmed in available reporting, treat the above as general hardening guidance rather than a confirmed detection strategy.

Developing Story

This is net-new intelligence based on a single published report; no CVE has been assigned in the source material reviewed, and official WordPress guidance or a patch confirmation has not yet been referenced. We will revisit this item as more technical detail or an official advisory becomes available. Original source: BleepingComputer.