Click2Shell and the 17 September WordPress security release (CVE-2026-93485)

The patched release for every WordPress branch back to 4.7, what the reported Click2Shell chain actually needs before it works, why the 9.6 in the headlines is not WordPress's own rating, and the one trace a forced theme install leaves behind.