Critical WordPress XSS2Shell flaw may lead to full server takeover

The WordPress XSS2Shell vulnerability chain can enable administrator account takeover and remote code execution. According to the source, the attack starts with an unregistered username processed on the login page and can lead to obtaining a valid Application Password, publishing content with administrator privileges, and executing a plugin containing arbitrary PHP code.