#Click2Shell
LightNews LightNews
chun-log-jp.bsky.social
WordPress 7.1.1へ更新済みでもCVE-2026-87902の修正は入っていません。
これはClick2Shellとは別の問題で、未ログインの第三者が細工したpagenameを送るとテーマの構造など条件次第でテーマ外のPHPファイルを読み込ませられます。
7.1系は7.1.2、旧系列は対応する修正版を確認してください。
https://chunlog.jp/wordpress-7-1-2-cve-2026-87902/?utm_source=bluesky&utm_medium=social&utm_campaign=post
#WordPress #セキュリティ
WordPress 7.1.2の脆弱性CVE-2026-87902とは？悪用状況と更新手順
WordPress 7.1.2で修正されたCVE-2026-87902とは。未ログインで試みられる攻撃の仕組みと観測状況、旧バージョン系列を含む修正版の確認方法、更新後に調べたい痕跡を解説します。
chunlog.jp
September 26, 2026 at 10:06 AM
chun-log-jp.bsky.social
WordPressのClick2Shellは、管理者がログイン中に細工されたリンクを開くと、公式ディレクトリのテーマが意図せずインストールされる問題です。テーマは有効化されないため、サイトの見た目だけでは気づけません。更新後も「外観」→「テーマ」で覚えのないテーマを確認してください。コード実行にはテーマ側の別の脆弱性も必要です。

https://chunlog.jp/wordpress-click2shell/?utm_source=bluesky&utm_medium=social&utm_campaign=post
#WordPress #Click2Shell
WordPressのClick2Shell脆弱性とは？7.1.1の修正内容と影響
WordPressのClick2Shellはログイン中の管理者に細工されたリンクを開かせテーマを自動インストールさせる脆弱性です。コード実行に必要な追加条件、7.1.1での修正と現在入れるべき7.1.2、更新後の確認先を整理します。
chunlog.jp
September 24, 2026 at 11:02 PM
feed.igeek.gamer-geek-news.com.ap.brid.gy
🐧 **WordPress 7.1.2 Release, Patches ‘Click2Shell’ Vulnerability**

new from WordPress

📰 Source: Tux Machines
🔗 Link: https://tuxmachines.org/n/2026/09/23/WordPress_7_1_2_Release_Patches_Click2Shell_Vulnerability.shtml
WordPress 7.1.2 Release, Patches ‘Click2Shell’ Vulnerability
new from WordPress
tuxmachines.org
September 24, 2026 at 6:07 PM
securitylab-jp.bsky.social
WordPress「Click2Shell」脆弱性、7.1.1で修正　管理者の1クリックでテーマ強制インストール、別の欠陥と連鎖しPHP実行
rocket-boys.co.jp/security-mea...

#セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース #脆弱性
WordPress「Click2Shell」脆弱性、7.1.1で修正 管理者の1クリックでテーマ強制インストール、別の欠陥と連鎖しPHP実行|セキュリティニュースのセキュリティ対策Lab
WordPress 7.1.1で修正された「Click2Shell」の技術詳細が公開。ログイン済み管理者が細工したリンクを開くとテーマを強制インストールされ、別のテーマ脆弱性と連鎖してPHP実行に至る可能性があります。PoCは公開済み、実悪用は未確認
rocket-boys.co.jp
September 24, 2026 at 1:14 AM
news.tuxmachines.org.web.brid.gy
WordPress 7.1.2 Release, Patches ‘Click2Shell’ Vulnerability
new from WordPress
tuxmachines.org
September 23, 2026 at 7:41 PM
winastuce.bsky.social
Vous gérez un site WordPress ? Un simple lien piégé peut permettre de le pirater siecledigital.fr/2026/09/21/v...
Vous gérez un site WordPress ? Un simple lien piégé peut permettre de le pirater
La faille, baptisée Click2Shell par les chercheurs de pwn.ai, devient bien plus dangereuse lorsqu'elle est combinée à une seconde vulnérabilité présente dans un thème WordPress. Un administrateur peut...
siecledigital.fr
September 23, 2026 at 7:01 PM
simsus.social.tchncs.de.ap.brid.gy
Sicherheitsupdates: #click2shell-Lücke zum Kompromittieren von #wordpress-Websites | Security https://www.heise.de/news/Sicherheitsupdates-Click2Shell-Luecke-zum-Kompromittieren-von-WordPress-Websites-11460973.html #patchday #cms #contentmanagementsystem
Sicherheitsupdates: Click2Shell-Lücke zum Kompromittieren von WordPress-Websites
Aufgrund mehrerer Sicherheitslücken raten die WordPress-Entwickler zu einem zügigen Update. Bislang gibt es keine Hinweise auf Attacken.
www.heise.de
September 23, 2026 at 3:13 PM
sambowne.infosec.exchange.ap.brid.gy
WordPress Click2Shell flaw lets hackers execute PHP on the server https://www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/
WordPress Click2Shell flaw lets hackers execute PHP on the server
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component.
www.bleepingcomputer.com
September 23, 2026 at 2:47 PM
wpsecurityninja.bsky.social
If you stopped at Click2Shell / 7.1.1, you are not done.

CVE-2026-87902 is unauth LFI in core template resolution. Patchstack saw probes the same day.

Update to 7.1.2 or your backport. Hunt logs for odd pagename + page_id.

Already patched? Drop a ✅. Agency life? Pass it to your clients.
September 23, 2026 at 1:33 PM
ninjaowl.ai
WordPress Click2Shell flaw lets hackers execute PHP on the server #cybersecurity #hacking #news #infosec #security #technology #privacy
WordPress Click2Shell flaw lets hackers execute PHP on the server
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component.
www.bleepingcomputer.com
September 22, 2026 at 8:54 PM
hacker.at.thenote.app
WordPress Click2Shell flaw lets hackers execute PHP on the server

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component. [...]
#hackernews #news
WordPress Click2Shell flaw lets hackers execute PHP on the server
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component. [...]
www.bleepingcomputer.com
September 22, 2026 at 7:05 PM
cybercod.bsky.social
Crucial info! WordPress users, update now. 'Click2Shell' is a serious RCE threat via theme installs. Prioritize patching! #WordPressSecurity
September 22, 2026 at 6:06 PM
tierrasapiens.bsky.social
🖲️ #Noticia #CiberSeguridad #Cybersecurity #CiberNoticia

Vulnerabilidad "Click2Shell" en WordPress fuerza la instalación de temas y puede encadenarse para lograr la ejecución de código

Leer Más / Read More...
Vulnerabilidad "Click2Shell" en WordPress fuerza la instalación de temas y puede encadenarse para lograr la ejecución de código
Haz clic para acceder al contenido completo.
blog.segu-info.com.ar
September 22, 2026 at 5:44 PM
thenewoil.org
#wordpress #click2shell flaw lets hackers execute #php on the server

https://www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/

#cybersecurity
WordPress Click2Shell flaw lets hackers execute PHP on the server
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component.
www.bleepingcomputer.com
September 22, 2026 at 4:04 PM
siecledigital.bsky.social
ICYMI: Vous gérez un site WordPress ? Un simple lien piégé peut permettre de le pirater
Vous gérez un site WordPress ? Un simple lien piégé peut permettre de le pirater
La faille, baptisée Click2Shell par les chercheurs de pwn.ai, devient bien plus dangereuse lorsqu’elle est combinée à une seconde vulnérabilité présente dans un thème WordPress. Un administrateur peut l’installer malgré lui en ouvrant simplement une adresse conçue à cet effet. WordPress a corrigé le problème le 17 septembre avec la version 7.1.1 et a rétroporté […]
dlvr.it
September 22, 2026 at 3:50 PM
it-connect.bsky.social
🛑 Click2Shell : une faille dans WordPress permet d’exécuter du code PHP en un clic

Un clic sur un lien piégé qui peut coûter cher si on est connecté en tant qu'admin à son #WordPress.

Plus d'infos par ici :
- www.it-connect.fr/wordpress-cl...
September 22, 2026 at 3:13 PM
darknetsearch.bsky.social
🚨Fake CAPTCHA → PowerShell exploit → brand risk.

🌐 spoofguard.io/blog/en/bran...

#CyberSecurity #BrandProtection #Click2Shell #Phishing #ThreatIntel #SpoofGuard

Try it for FREE. 🆓
Brand Protection Software: What Click2Shell Means for WordPress | Spoofguard.io
✓ Brand protection software can help track phishing risks after Click2Shell. Learn what the WordPress flaw means, how to investigate exposure, and what to patch.
spoofguard.io
September 22, 2026 at 2:51 PM
aixzellent.bsky.social
Sicherheitsupdates: Click2Shell-Lücke zum Kompromittieren von WordPress-Websites | Security www.heise.de/news/Sicherh...
Sicherheitsupdates: Click2Shell-Lücke zum Kompromittieren von WordPress-Websites
Aufgrund mehrerer Sicherheitslücken raten die WordPress-Entwickler zu einem zügigen Update. Bislang gibt es keine Hinweise auf Attacken.
www.heise.de
September 22, 2026 at 2:20 PM
wpsecurityninja.bsky.social
WordPress 7.1.1 (17 Sep) patched Click2Shell and Comment2Shell (CVE-2026-93485). Public PoCs and mainstream write-ups landed 21–22 Sep.

Agency checklist:
1) Confirm every install is on 7.1.1 or your branch’s security backport
2) Check inactive themes you did not expect
3) Tighten comment moderation
September 22, 2026 at 1:44 PM
hendryadrian.bsky.social
WordPress 7.1.1 patches 11 flaws, including Click2Shell, a vulnerability that could let attackers force a theme install via malicious preview URLs and potentially run PHP code on the server. #WordPress #Click2Shell #pwnai
WordPress Patches ‘Click2Shell’ Vulnerability
WordPress patched 11 vulnerabilities last week, including Click2Shell, a flaw that could allow remote code execution through specially crafted theme-preview URLs. pwn.ai found that an unauthenticated attacker could force installation of an attacker-selected theme and potentially execute PHP code on the server, earning a $300 bug bounty for the report. #Click2Shell...
www.hendryadrian.com
September 22, 2026 at 12:45 PM
offseq.bsky.social
WordPress patched the CRITICAL Click2Shell flaw (v4.7 – 7.1.0). Attackers could trigger remote code execution via inactive theme previews. Update to 7.1.1 or apply security backports immediately. https://radar.offseq.com/threat/wordpress-patches-click2shell-vulnerability-f550dfa1d978a913 #OffSeq ...
WordPress Patches ‘Click2Shell’ Vulnerability
The Click2Shell vulnerability in WordPress arises from inconsistent interpretation of a value in the theme-preview URL by the themes API and the JavaScript running in an administrator's browser. The API reduces the value to a standard theme
radar.offseq.com
September 22, 2026 at 12:00 PM
laronskigeek.bsky.social
🤬 WordPress security flaw lets hackers run PHP code on servers. Like the Equifax breach, but this time it's a plugin— stay updated and patched. https://gigcitygeek.com/211127
WordPress Click2Shell flaw lets hackers execute PHP on the server
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed
gigcitygeek.com
September 22, 2026 at 11:54 AM
digitalmatters.bsky.social
WordPress 7.1.1 Patched Click2Shell, and the Core Bug Was a Disagreement About One String

WordPress 7.1.1 shipped on September 17, 2026 carrying eleven security fixes, seventeen core bug fixes and…

http://digitalmatters.me/security/wordpress-7-1-1-click2shell/

#Cyber_Security #Security #WordPress
WordPress 7.1.1 Patched Click2Shell, and the Core Bug Was a Disagreement About One String
WordPress 7.1.1 shipped on September 17, 2026 carrying eleven security fixes, seventeen core bug fixes and nineteen fixes for the block editor. One of those eleven arrived with a name, a research writeup and, within days, public exploit code. It is called Click2Shell. The interesting part is not that it ends in remote code execution. Plenty of chains do. The interesting part is that the core half of it contains no missing escape, no forgotten permission check and no line that looks wrong in review.
digitalmatters.me
September 22, 2026 at 11:39 AM
postac001.bsky.social
WordPressの「Click2Shell」脆弱性により、攻撃者はテーマの自動インストール・プレビューが可能になり、リモートコード実行に繋がる恐れがあります。
WordPress Patches 'Click2Shell' Vulnerability
WordPress has patched Click2Shell, a vulnerability that allows attackers to install themes and achieve remote code execution.
www.securityweek.com
September 22, 2026 at 11:29 AM