New WordPress Core CSRF Bug ‘Click2Shell’ Enables Remote PHP Execution

A critical cross‑site request forgery (CSRF) flaw dubbed “Click2Shell” has been disclosed in the core of WordPress, the world’s most widely used content‑management system. Security researchers have released technical details and a proof‑of‑concept exploit that demonstrate how an attacker can trigger arbitrary PHP code execution on a vulnerable site’s server.

The vulnerability resides in a core component that processes certain admin‑area requests without adequate verification of the originating user. By crafting a malicious link or embedding a hidden form on a third‑party site, an attacker can cause a logged‑in WordPress administrator to unknowingly send a request that writes a PHP payload to the server’s filesystem. Once the payload is in place, the attacker can run arbitrary commands, potentially taking full control of the host.

WordPress powers an estimated 43 percent of all websites, making any flaw in its core code a high‑profile target. CSRF attacks are not new to the platform, but the “Click2Shell” vector is notable for its simplicity: it does not require the attacker to discover a separate vulnerability or to exploit a plugin. Instead, the exploit leverages the trusted relationship between a logged‑in admin and the WordPress backend, a scenario that can arise in everyday workflows such as clicking a link in an email or browsing a compromised blog.

The details were first reported by BleepingComputer, which published the research alongside a proof‑of‑concept script. The authors of the research chose to disclose the vulnerability publicly after responsible notification attempts, aiming to prompt rapid remediation across the ecosystem. They emphasized that the exploit works on any WordPress installation that has not applied the forthcoming patch or mitigations.

WordPress’s security team has acknowledged the issue and is expected to issue a security update in an upcoming release. In the meantime, the project’s maintainers recommend administrators enable two‑factor authentication, limit admin sessions, and apply the “no‑untrusted‑post‑requests” hardening guidelines that were introduced in recent core updates. Site owners are also urged to audit logs for unexpected admin actions and to scan for newly created PHP files in writable directories.

Security experts note that the incident underscores the importance of keeping core WordPress installations, themes, and plugins up to date. While the platform’s open‑source model allows rapid patch distribution, the sheer number of sites running outdated versions can prolong exposure. Organizations that host WordPress sites as part of larger infrastructures are advised to incorporate automated vulnerability scanning and to enforce least‑privilege principles for administrative accounts.

As the community awaits the official patch, the “Click2Shell” disclosure serves as a reminder that even mature, widely audited software can harbor critical weaknesses. Stakeholders—from individual bloggers to enterprise‑level publishers—are expected to monitor official WordPress channels for the security release and to apply recommended mitigations promptly to protect their sites from potential compromise.