WordPress site operators have another core update to prioritize after researchers disclosed technical details and a proof-of-concept for a vulnerability dubbed Click2Shell.

BleepingComputer reports that the issue is a pre-authenticated remote-code-execution chain affecting WordPress Core and that it was addressed in WordPress 7.1.1. The report says the chain can abuse the theme preview/install flow so that an attacker can get a theme from the official WordPress.org catalog onto a site and then run a PHP file.

That makes the story directly relevant for managed WordPress hosts, agencies, and self-managed VPS customers: even when the entry point involves an administrator’s browser, the outcome is server-side code execution on a hosting account.

What hosts and site owners should do

• Update WordPress Core to the fixed release as soon as change windows allow.
• Review recent theme and plugin installation activity on high-value sites.
• Temporarily restrict file modifications where emergency patching is delayed; the BleepingComputer report notes that sites with DISALLOW_FILE_MODS enabled are not forced through the same install path.
• Ask managed hosting providers whether fleet-level virtual patching, WAF rules, or malware scanning have been adjusted for Click2Shell attempts.

The practical takeaway: WordPress patch latency remains a hosting risk, not just an application maintenance chore. Providers that run large WordPress fleets should treat this as a customer-communication and monitoring event, especially now that exploit details are public.

Source: BleepingComputer — “WordPress Click2Shell flaw lets hackers execute PHP on the server”.