Critical Click2Shell Vulnerability Exposes WordPress Sites to Remote Code Execution

WordPress site owners are being advised to update immediately following the disclosure of Click2Shell, a newly identified attack chain that can allow threat actors to escalate a single malicious link into remote code execution (RCE) on vulnerable WordPress installations.

The vulnerability originates from a flaw in WordPress Core’s theme preview functionality, which can be abused to silently install a theme from the official WordPress.org repository. When paired with insecure code present in certain themes, this behavior can create a pathway for attackers to execute arbitrary code on the underlying server.

To address the issue, WordPress released version 7.1.1 on September 17, 2026. The update includes 11 security fixes, 17 Core bug fixes, and 19 Block Editor improvements. According to the official advisory, specially crafted URLs could trigger the automatic installation and preview of an inactive theme, potentially enabling further exploitation. The vulnerability was reported by security researcher Paulos Yibelo and the team at pwn.ai.

Notably, attackers do not need a WordPress account to launch the attack. However, exploitation requires a logged-in administrator to interact with a specially crafted malicious URL.

Understanding the Click2Shell Attack Chain

The attack leverages the permissions already granted to an authenticated administrator. By abusing trusted WordPress functionality, attackers can cause privileged actions to be performed within the administrator’s active session without requiring direct access to the site.

Researchers found that the issue stems from the way WordPress processes theme-related input during the installation workflow. While the WordPress.org Themes API converts supplied input into a valid theme identifier, the browser handles the original input differently when constructing a jQuery selector.

By manipulating that selector with specially crafted characters, an attacker can break out of the intended element targeting logic and trigger the legitimate Install Theme action automatically. As a result, WordPress installs a theme chosen by the attacker from the official WordPress repository.

Importantly, the initial flaw does not allow attackers to upload arbitrary files or immediately execute code. The installed theme remains inactive and is sourced from a trusted repository, making the activity difficult for administrators to detect because there is no obvious impact on the site’s appearance or functionality.

From Unauthorized Theme Installation to Server Compromise

The more serious risk emerges when the forced theme installation is combined with a vulnerable theme.

Researchers demonstrated the complete attack chain using Mobile Repair Zone 2.5.4, a theme that exposed an authenticated AJAX endpoint lacking both proper authorization controls and nonce validation. During a theme preview operation, WordPress loaded PHP code contained within the inactive theme, inadvertently exposing functionality that could be abused by an attacker.

The vulnerable endpoint accepted attacker-controlled plugin information and external package URLs, then downloaded and extracted malicious content before loading attacker-supplied PHP code. This sequence ultimately led to remote code execution on the server.

A successful compromise could enable attackers to:

• Access WordPress configuration files and database credentials.
• Read, modify, or delete WordPress and WooCommerce data.
• Create unauthorized administrator accounts.
• Alter website content and application files.
• Steal sensitive information accessible to the web server process.
• Potentially expands access into the broader hosting environment.

In the demonstrated attack chain, the WordPress Core flaw acts as the initial access mechanism, while the vulnerable theme provides the bridge to full server-side code execution.

Remediation and Security Recommendations

WordPress addressed the vulnerability in changeset 63664 by strengthening selector handling within the theme installation workflow. The patch restricts matching to legitimate theme elements and utilizes jQuery’s escapeSelector() function to ensure user-controlled input is treated as data rather than executable selector syntax.

Researchers rated the standalone forced-theme installation issue as High Severity (CVSS 7.1), while the complete Click2Shell attack chain capable of achieving remote code execution was assessed as Critical. At the time of disclosure, there was no public evidence indicating active exploitation in the wild.

Organizations running WordPress should prioritize updating to WordPress 7.1.1 or the latest security release available for their supported version branch.

Administrators should also:

• Confirm that automatic updates are enabled.
• Review recently installed themes and plugins for unauthorized changes.
• Investigate unexpected PHP files or modifications.
• Audit privileged user accounts for suspicious activity.
• Monitor requests targeting theme-install.php.
• Review activity involving Customizer-related admin-ajax.php endpoints.
• Examine server and application logs for signs of unauthorized theme installations.

While no active exploitation has been publicly reported, prompt patching and routine environment reviews remain the most effective defenses against compromise.