WordPress Click2Shell Flaw Enables PHP Execution via Theme Preview Chain

·64 views

A high-severity vulnerability chain dubbed Click2Shell affects WordPress Core versions 7.1.0 and select releases across branches 7.0 through 4.8, allowing unauthenticated attackers to trigger remote PHP execution. By luring an administrator to a crafted URL, the flaw exploits a selector injection in WordPress Core that automatically installs an official theme from the WordPress.org catalog without any explicit admin action. When chained with a vulnerable theme, a follow-on request to admin-ajax.php causes the inactive theme's functions.php to load and fetch an attacker-specified plugin ZIP, ultimately executing arbitrary PHP under the server's web worker account. WordPress has released patched versions — including 7.1.1, 7.0.5, 6.9.8, and 4.8.31 — with fixes backported across all affected branches. Administrators are advised to update immediately, remove unused themes, and restrict outbound traffic and plugin installation permissions as additional mitigations.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Glimpse Developer Adds Live Note-Taking to Meeting App After Using It in Lectures

A developer spent a year building Glimpse, a dictation and meeting app, largely on their own. After matching the features users expect from dictation tools, they focused on meeting mode, drawing inspiration from MacWhisper. When MacWhisper launched live transcripts, the developer added a similar feature to Glimpse. Using it during lectures revealed shortcomings, such as the app listening for too long or too short a time and not indicating which model was processing the live notes. The developer's takeaways are to copy what users expect, scrutinize what you dislike even in copied features, and use your own product constantly to catch problems before others do.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OAB Sets Guardrails Requiring Human Lawyer Oversight of AI in Legal Services

A DEV Community article outlines technical and ethical guardrails meant to limit how artificial intelligence is used in Brazilian legal work. It says the Brazilian Bar Association (OAB) requires that any AI-assisted legal output be directly supervised and signed off by a registered lawyer, and that responsibility for AI-driven errors rests with the lawyer rather than the technology provider. The piece cites the Estatuto da Advocacia, OAB opinions and resolutions, and reported court practice, noting courts tend to reject filings whose authorship cannot be clearly attributed to a qualified professional. Suggested safeguards include blocking unsigned AI outputs, mandatory warnings on sensitive topics, immutable logs of AI interactions, and disabling automated drafting of complex documents. The article presents these as current expectations in the profession rather than a new regulatory announcement.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Setting Up External DNS with Cloudflare on a Local Kubernetes Cluster

This installment of a Kubernetes series explains how to deploy External DNS to automate DNS record management on a local cluster. The author uses Cloudflare as the DNS provider and follows declarative GitOps practices with Flux. The process starts by generating a zone-scoped Cloudflare API token and storing its credentials in a Kubernetes secret, which is encrypted with SOPS before being committed to Git. The External DNS deployment is then defined through a ServiceAccount, a read-only ClusterRole and binding, and a Deployment that watches ingresses and syncs records to Cloudflare. The article notes that the setup builds on earlier steps for routing external traffic to the cluster so it can be reached via a public IP.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DEV community asks which single fix users would make to the platform

A DEV Community post invites readers to name the one thing they would fix on the platform if given a magic wand. The author asks for a single answer, which can be a feature, rule, bug, or aspect of how the feed works. The author gives an example: a way to understand why a post received few views, which would especially help new writers who get no initial readers. The post notes that, without such insight, writers can only guess at the reason. The author states they will read every reply.

0 comments Read more at DEV Community