WordPress Click2Shell flaw lets hackers execute PHP on the server.

An attack could start with a crafted link that leads to installing a vulnerable theme in the catalog. Once the Customizer preview loads the inactive theme's PHP, the code is executed on the server.

Read more here: https://www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/