WordPress Click2Shell CSRF-to-RCE Vulnerability
First seen Sep 22, 2026 · Updated Sep 22, 2026 · CVSS 8.1
A newly disclosed cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' affects WordPress Core, allowing attackers to trick authenticated administrators into performing actions that lead to arbitrary PHP code execution on the server. A public proof-of-concept exploit has been released, significantly raising the risk of active exploitation against unpatched WordPress installations.
Technical Analysis
The Click2Shell flaw resides in WordPress Core and exploits insufficient CSRF protections on an administrative endpoint, allowing an attacker to craft a malicious request that, when triggered by a logged-in admin, results in PHP file write or plugin/theme upload actions leading to remote code execution. Because the vulnerability chains a CSRF primitive with a file-write or code-execution sink, it bypasses typical authentication checks by abusing the victim's existing session. The public availability of a PoC exploit lowers the barrier for mass exploitation via phishing links or malicious ads targeting WordPress admins. If AI agents or automation pipelines interact with WordPress sites as a backend (e.g., agent-driven content management, CMS automation bots, or RAG systems scraping/indexing WordPress content), a compromised server could serve as an initial foothold to inject malicious payloads into content ingested by agents, or expose API keys and credentials stored in the WordPress environment used by agent tooling.
Affected Systems
WordPress Core (specific vulnerable version range not yet fully disclosed in source data); affects self-hosted WordPress installations with administrator-level user sessions active in browsers susceptible to CSRF attacks.
Indicators of Compromise
- No specific IOCs (hashes, IPs, domains) published at this time; monitor for anomalous admin-panel POST requests and unexpected PHP file creation in wp-content/uploads or plugin directories.
Remediation Steps
- 1
Apply WordPress Core Update
Monitor WordPress.org security releases and apply the patched Core version as soon as it is available.
- 2
Implement CSRF Nonce Verification
Ensure all admin-facing forms and AJAX endpoints properly verify WordPress nonces and referer headers.
- 3
Restrict Admin Session Exposure
Enforce short session timeouts, SameSite cookie attributes, and re-authentication for sensitive actions to reduce CSRF attack surface.
- 4
Monitor for Unauthorized File Changes
Deploy file integrity monitoring on wp-content directories to detect unauthorized PHP file creation.
- 5
Limit Admin Browsing Behavior
Advise administrators to avoid browsing untrusted sites or clicking unknown links while authenticated to the WordPress dashboard.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.