Warning: The Click2Shell and Comment2Shell vulnerabilities in WordPress can lead to remote code execution and full website compromise, Patch Immediately!
ID: 4a16e089-85dd-5d35-b6dd-a2a6b560e14d
STIX ID: report--4a16e089-85dd-5d35-b6dd-a2a6b560e14d
Threat Score
WordPress 7.1.1 addresses 11 security issues, most notably two remote code execution flaws: Click2Shell (a CSRF-driven chain that forces a theme install and leverages a malicious theme for RCE) and Comment2Shell (CVE-2026-93485), an unauthenticated stored XSS in wpautop() that can become executable markup; administrators are urged to update immediately and increase monitoring for signs of compromise.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.