New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution

{"heading_1":"The Core Bug","paragraph_1":"WordPress advises updating to 7.1.1 immediately. If you cannot update at once, note that neither WordPress nor pwn.ai offered a separate workaround for this attack.","paragraph_2":"Updating WordPress core closes the demonstrated attack, regardless of the theme a site runs. The fix is available in WordPress 7.1.1, which is part of a security release that reaches supported branches back to 4.7.","paragraph_3":"The security release notes confirm this flaw from version 6.0 up through the releases just before the fix. Site owners should install 7.1.1, or the matching update for whichever branch they run, and sites set to update automatically will receive it on their own.","heading_2":"The Theme Flaw","heading_3":"Workaround and Recommendations"}