WordPress Click2Shell Flaw Allows PHP Execution

WordPress patched a pre-authenticated remote code execution flaw called Click2Shell in version 7.1.1. The chain lets attackers force-install any theme from the official catalog and run arbitrary PHP, but requires a logged-in administrator to visit a crafted URL.