WordPress Multiple Vulnerabilities

Multiple vulnerabilities were identified in WordPress. A remote attacker could exploit some of these vulnerabilities to trigger cross-site scripting, security restriction bypass, sensitive information disclosure, remote code execution and data manipulation on the targeted system.

A proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell'. It is a pre-authenticated remote code execution chain that allows an attacker to install any theme in the official WordPress.org catalog and run an arbitrary PHP file. It should be noted that although the attacker does not need to authenticate, the Click2Shell exploit requires a site administrator who is already logged in to visit a specially crafted URL. Hence, the risk level is rated as High Risk.

Before installation of the software, please visit the vendor web-site for more details.

Note: No CVE information is available for this vulnerability