Public exploit code released for Click2Shell vulnerability
3 Sep 21 2:23 PM · 2d ago · 1 post · 1 source · development 3 of 3
Technical details and proof-of-concept exploits for Click2Shell were published, making the attack methodology publicly available. The vulnerability is classified as a cross-site request forgery (CSRF) flaw in WordPress Core.
pwn.ai Security research firmWordPress Software vendor
The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump
Reported in the same hours no headline names this development itself — these 4 claims were published in its stretch
-
first by heise online, 21h ago · also SecurityWeek
1 more headline
- WordPress Patches ‘Click2Shell’ Vulnerability SecurityWeek · 21h ago
-
first by Mastodon, 19h ago · also The Hacker News
-
1 outlet WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)
first by Help Net Security, 21h ago
-
first by HN Frontpage, 1d ago
What people said 24 voices · best of 28 · verbatim
-
All WordPress users need to update their WordPress installations immediately 💯 There is a 9.2 CVE that discloses a remote code execution vulnerability that affects versions all the way back to 2016 😬 Here's the official notice
-
C
WordPress patched an unauth path traversal yesterday: https:// github.com/WordPress/wordpress -develop/security/advisories/GHSA-7hp8-65ch-5whp https:// wordpress.org/news/2026/09/wor dpress-7-1-2-release/ This is now being exploited, a few hours later: https:// x.com/ethicalhack3r/status/210 2747373873004680
-
This kind of bug pathology is incredibly common in all sorts of programs and is the reason (disclaimer: self-plug) I wrote libpathrs[1].Sadly, almost all language standard libraries do not provide the right abstractions for dealing with files (the primary focus is on global paths as opposed to scoped paths or file descriptors / file handles) so…
-
T
WordPress patched a critical unauthenticated path traversal vulnerability (CVE-2026-87902, GHSA-7hp8-65ch-5whp, CVSS 9.2) in its page-template resolution function get_page_template(), discovered and responsibly disclosed by Robert Ressl. Under specific preconditions, such as an active theme with a top level directory starting with "page-" and a…
-
It's a wonderful piece of software. We've had one of our clients wanting us to "just provide a simple PHP install for wordpress, just hosting" (among some more complex java stuff company wrote for them).Site hacked within a day from install. Thankfully we have limited outogoing traffic (whitelist on proxy) so only thing exploit managed to replace…
-
O
「WordPressのClick2Shellの脆弱性により、ハッカーがサーバー上でPHPを実行できる。」： # BLEEPINGCOMPUTER 「WordPressのコアコンポーネントに影響を与える、Click2Shellと呼ばれる新たなクロスサイトリクエストフォージェリ（CSRF）脆弱性に関する技術的な詳細と概念実証エクスプロイトが公開されました。 このセキュリティ問題には公式な識別番号は付けられていませんが、先週リリースされた WordPressバージョン7.1.1 で対処されました。 これは、攻撃者が公式のWordPress.orgカタログにある任意のテーマをインストールし、任意のPHPファイルを実行できるようにする、事前認証済みのリモートコード実行チェーンです。」…
-
Ironically, this 9 years old comment on the official documentation page of one of the affected functions perfectly describes both the nature and remediation of this major security flaw:> Paul Ryan 9 years ago> Note that locate_template() does not prevent directory traversal attacks, so if you’re passing a user-provided template name to the…
-
B
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component. https://www. bleepingcomputer.com/news/secu rity/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/
-
There was a time I looked up to Matt Mullenweg, but never to Wordpress.I've been building https://github.com/Qbix since 2008 and let me tell ya, I took a lot of great ideas from Drupal, Kohana, Symfony, etc. But never Wordpress. It's just ... a mess. Wordpress just won by being first, basically. Kind of like Bitcoin.PS: Years ago, I hired a guy in…
-
B
Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. https://www. bleepingcomputer.com/news/secu rity/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/
-
If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates.People on HN love to talk smack about WordPress. After all these years, it's as much a reflex as shouting "walled garden!" every time there's an Apple story.Yet some of the biggest web sites on the…
-
N
WordPress: Unauthenticated path traversal leading to conditional RCE: https:// github.com/WordPress/wordpress -develop/security/advisories/GHSA-7hp8-65ch-5whp Discussion: http:// news.ycombinator.com/item?id=4 9803959
-
WordPress really is a piece of garbage software, and if you've ever developed plugins for it it is soooo apparent.The documentation is a perfect reflection of the absolute mess of spaghetti code that it is, half of the methods that you will use constantly when developing plugins are undocumented, even untyped. It's literally unusable.I know…
-
P
Jesus, just STOP USING FUCKING WORDPRESS. https:// github.com/WordPress/wordpress -develop/security/advisories/GHSA-7hp8-65ch-5whp
-
The access log of public http servers is truly interesting to watch.You know that the scripts doing it are optimized for success rate, so the types of requests they send give you an impression of what's actually out there.It's clear to me that once we finally achieve rogue AGI, it is going to propagate through unpatched WordPress WooCommerce…
-
These are the reason, why every easily reachable web server will be spammed with /something/something.php?somearg=someval. If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates. Maybe right after MS Teams or Sharepoint or some stuff like that.
-
"WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7"As a courtesy, I try not to say more than one bad thing about WP every day. FWIW about 1/3 of installs are not on the recent 7 branch.
-
Every so often I switch on the nginx endpoint that serves a 10TB zipbomb to clients that request anything `wp-*` that 404s (which is everything on my sites, I don't run WordPress).Sometimes the same IP address hits two or three URLs before going dead.Sure is quiet around here at night.
-
pearcmd.php must exist, and register_argc_argv must be on, not common with hosting providers. But I am assuming the other themes and meeting conditions possibly affect a lot of WordPress sites.
-
Wordpress was the go-to for people who did not know programming and wanted a website.Has anything changed with AI? It did help me switch from wp to rust+dioxus, but I am a programmer.
-
TBF, some of it is structural: if you're the most popular anything on the internet, you'll be the most attacked and the most exploited, and hence the most exploitable.
-
I am so happy that I asked Codex to rewrite our website as Hugo templates which allowed us to statically host it and get rid of Wordpress. So much stress gone!
-
to be fair it is one of the top CMS's on the web (probably won't be in 2027) and its PHP / Mysql which in history have been very exploitable.
-
Is there a simple quick fix for older wp installs? I dont want to go through 20 meetings and two weeks of discussions
All 3 developments of WordPress Click2Shell Flaw Lets Admins Unwittingly Install… →
Google NewsMastodonNewswiresHacker NewsX