WordPress Pre-Authentication Remote Code Execution Vulnerability “Click2Shell” (CVE-Unknown)

Itsc.Cuhk.Edu.Hk • September 21, 2026

Us – Organization Vision and Mission Major Projects Core and Fee-charging Service Charges of Fee-charging ITSC Services (2026-27) ITSC Specific Guidelines ITSC eNewsletter Opening Hours and

Us – Organization

Core and Fee-charging Service

Charges of Fee-charging ITSC Services (2026-27)

ITSC Specific Guidelines

Opening Hours and

Staff New Staff Staff Account Mass Mail Microsoft 365 Mail Central Authentication and Directory Service (CADS) Students New Student Student Account @Link Email User Areas Learning Commons Student Organization Account All MyCUHK / CUSIS CUHK VPN DUO 2FA Anti-virus Software on PCs More>

Central Authentication and Directory Service (CADS)

Student Organization Account

Anti-virus Software on PCs

Change OnePass Password Forgot Password Enrol in Duo 2FA for new users Transfer Duo 2FA to my new phone Collect New Staff Account Collect New Student Account Microsoft Copilot for the Web Define Email Address (via Campus Network or CUHK VPN) Manage Project / Other Account(s) (via Campus Network or CUHK VPN) More>

Change OnePass Password

Enrol in Duo 2FA for new users

Transfer Duo 2FA to my new phone

Collect New Staff Account

Collect New Student Account

Microsoft Copilot for the Web

Define Email Address (via Campus Network or CUHK VPN)

Manage Project / Other Account(s) (via Campus Network or CUHK VPN)

Service Maintenance of the ITSC Public Website (Mon, 21 Sep 2026, 5:30 p.m. – 6:00 p.m.) WordPress Pre-Authentication Remote Code Execution Vulnerability “Click2Shell” (CVE-Unknown) Cisco Identity Services Engine (ISE) API Authentication Bypass Vulnerability (CVE-2026-76460) Services Maintenance of MyCUHK and CUSIS (Sun, 27 Sep 2026, 8:00 p.m. – 11:30 p.m.) Phishing Alert: Invoice #10112250964 – Follow-Up on Payment Status_ Check Today Service Status More >

Service Maintenance of the ITSC Public Website (Mon, 21 Sep 2026, 5:30 p.m. – 6:00 p.m.)

WordPress Pre-Authentication Remote Code Execution Vulnerability “Click2Shell” (CVE-Unknown)

Cisco Identity Services Engine (ISE) API Authentication Bypass Vulnerability (CVE-2026-76460)

Services Maintenance of MyCUHK and CUSIS (Sun, 27 Sep 2026, 8:00 p.m. – 11:30 p.m.)

Phishing Alert: Invoice #10112250964 – Follow-Up on Payment Status_

ITSC Tech Buddy Knowledge Base Online Service Desk ( Staff / Student / Guest ) Service Desk on Campus (+852) 39438845 User Trainings

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical WordPress Vulnerabilities Expose Sites to Remote Code Execution Two significant vulnerabilities affecting WordPress have been reported. The first, CVE-2026-87902, allows unauthenticated remote attackers to exploit local file inclusion leading to remote code execution. This vulnerability is due to improper validation during page-template resolution and could compromise affected websites. The second vulnerability, referred to as 'Click2Shell', is a pre-authentication remote code execution flaw but lacks a CVE identifier. Both vulnerabilities are critical, with CVE-2026-87902 published on September 22, 2026, and a proof-of-concept released on September 23, 2026. Administrators are urged to apply patches immediately to mitigate risks. 2 sources 71

Extracted Entities

WordPress Pre-Authentication Remote Code Execution Vulnerability “Click2Shell” (CVE-Unknown)

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Vulnerabilities (2)