Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

WordPress core security release (7.1.1)

Security Patch Release
First reported
Last updated
Happening score
H score 45
2 unique sources, 2 articles

Summary

Hide ▲

WordPress 7.1.1 is a security release that fixed the Click2Shell WordPress Core flaw, a CSRF issue that could let a logged-in administrator open a crafted link and trigger a theme install from WordPress.org without clicking Install. pwn.ai said the flaw can be chained with a separate weakness in the Mobile Repair Zone theme to reach server-side code execution and run attacker PHP. The published report says the issue can be abused through a crafted URL and was fixed in WordPress 7.1.1, with support covering branches back to 4.7.

Related Happenings

Elementor CSRF bypass mitigation (4.3.2)

Advisory/Mitigation
H score83 First: 25.09.2026 21:13 Last: 25.09.2026 21:13 Sources 1

About this happening: Elementor users are being told to upgrade to version 4.3.2 immediately to block a CSRF bypass that can let a logged-in administrator perform attacker-triggered REST AP...

Open Happening

Elementor plugin for WordPress security fix in 4.3.2

Security Patch Release
H score30 First: 25.09.2026 21:13 Last: 25.09.2026 21:13 Sources 1

About this happening: The Elementor team shipped version 4.3.2 of the Elementor plugin for WordPress to fix a CSRF flaw that could let attackers create administrator accounts on vul...

Open Happening

WordPress security patch release for CVE-2026-87902

Security Patch Release
H score47 First: 23.09.2026 21:31 Last: 23.09.2026 21:31 Sources 1

About this happening: WordPress released version 7.1.2 to fix CVE-2026-87902, a critical unauthenticated path traversal flaw that can lead to remote code execution under specific co...

Open Happening

WooCommerce Wholesale Lead Capture plugin 2.0.3.2 security update (CVE-2026-27540)

Security Patch Release
H score9 First: 15.09.2026 17:45 Last: 15.09.2026 17:45 Sources 1

About this happening: The WooCommerce Wholesale Lead Capture plugin's version 2.0.3.2 release closed CVE-2026-27540, an unauthenticated arbitrary file-upload flaw that let attackers upl...

Open Happening

ThemeFusion security patch release for CVE-2026-18431

Security Patch Release
H score43 First: 27.08.2026 00:33 Last: 27.08.2026 00:33 Sources 1

About this happening: ThemeFusion released security fixes for Avada and Fusion Builder after disclosure of CVE-2026-18431, a critical 9.8 chain that can lead to arbitrary PHP code...

Open Happening

Timeline

  1. 18.09.2026 19:56 2 articles · 13d ago

    WordPress ships 7.1.1 security release for Click2Shell

    Mitigation Patch Update

    WordPress shipped 7.1.1 on September 17, 2026 to fix a core flaw that could let a logged-in administrator open a crafted link and automatically install a theme from WordPress.org without clicking Install; the security release covered supported branches back to 4.7.

    Show sources
    Open in new tab
  2. 18.09.2026 19:56 2 articles · 13d ago

    pwn.ai details Click2Shell chain to server-side code execution

    Initial Disclosure

    pwn.ai called the attack chain Click2Shell and showed that the WordPress core flaw could be combined with a separate weakness in the Mobile Repair Zone theme to run attacker code on the server; WordPress described the issue as specially crafted URLs that can automatically install and preview an inactive theme from WordPress.org.

    Show sources
    Open in new tab