Reported by 4 outlets

Timeline

1. original reporting

   WordPress RCE Vulnerability Lets Authenticated Authors Execute Remote Code

   gbhackers.com · 62d ago · August 13th, 2026

   WordPress has released version 7.0.4 to address a high-impact authenticated remote code execution (RCE) vulnerability. This flaw could allow users with Author-level privileges or higher to execute code on affected websites. The vulnerability, tracked as CVE-2026-65640 and GHSA-8vr3-7mxf-gx8w, affects WordPress installations that use the Imagick extension alongside Ghostscript to process uploaded files. The security release […] The post WordPress RCE Vulnerability Lets Authenticated Authors Execute Remote Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. mentioned by securityweek.com

   WordPress 7.0.4 Patches Remote Code Execution Vulnerability

   securityweek.com · 61d ago · August 13th, 2026

3. update from cyberpress.org

   Click2Shell WordPress Flaw Lets Attackers Execute PHP Code and Take Over Websites

   cyberpress.org · 23d ago · September 21st, 2026

   A newly disclosed WordPress Core vulnerability chain, dubbed Click2Shell, allowed unauthenticated attackers to force a logged-in Administrator’s browser to silently install a malicious theme and ultimately achieve remote code execution (RCE) with a single malicious link click. Security researchers at PWNAI discovered that WordPress’s theme-preview URL parameter is interpreted inconsistently by two different components. The WordPress.org Themes API canonicalizes the theme parameter into a legitimate slug, while the browser-side JavaScript in wp-admin/js/theme.js preserves the raw, attacker-supplied string and injects it directly into a jQuery CSS selector. Click2Shell WordPress Flaw By crafting a value such as twentytwenty"]>>>/ , an attacker could break out of the intended selector scope and cause WordPress’s own script to automatically trigger the genuine “Install” button with no admin interaction, no nonce theft, and no install_themes capability required from the attacker. The victim’s authenticated session supplies everything. On its own, this forces installation of an official catalog theme without activating it. PWNAI then found that WordPress loads a theme’s functions.php during Customizer preview even while it remains inactive. Combined with a separate, unrelated bug in the (then-current) Mobile Repair Zone 2.5.4 theme, an AJAX handler registered without nonce or capability checks that accepted an attacker-controlled plugin package URL, the chain escalated from for

4. update from gbhackers.com

   Click2Shell WordPress Flaw Lets Hackers Execute PHP Code and Take Over Websites

   gbhackers.com · 23d ago · September 21st, 2026

   A recently disclosed WordPress vulnerability, known as Click2Shell, could let attackers execute remote PHP code on vulnerable sites after convincing a logged-in administrator to click a specially crafted link. WordPress version 7.1.1, released on September 17, 2026, addresses this issue.