New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution

WordPress has released patches for vulnerabilities in its core software, including one that allows a malicious link to install a theme from the official WordPress directory without user interaction when opened by a logged-in administrator. This flaw is part of an attack chain referred to as Click2Shell by the security firm pwn.ai, which reported the issue. The vulnerability can be triggered by a crafted web link. On its own, the flaw has limited impact.