Critical WordPress Click2Shell flaw lets attackers execute arbitrary PHP code

The pre-authenticated Click2Shell remote code execution chain in WordPress Core allows an attacker to force-install a theme from the official WordPress.org catalog and execute an arbitrary PHP file. For the attack to work, a logged-in administrator must visit a crafted link.