Click2Shell: The RCE WordPress 7.1.1 Just Patched
WordPress 7.1.1 patches Click2Shell, a CSRF-to-selector-injection chain letting attackers gain remote code execution via crafted links clicked by admins.
WordPress 7.1.1, released 17 September 2026, fixes a chain reported by Paulos Yibelo of pwn.ai that abuses an unsanitized theme slug in wp-admin JavaScript. The slug is injected into a jQuery selector, tricking an admin's browser into installing an attacker-chosen theme; the chain then abuses an AJAX handler in theme Mobile Repair Zone 2.5.4 that lacks nonce and capability checks, allowing a malicious plugin ZIP to be installed and executed server-side for full RCE. Exploitation requires an administrator to load a crafted URL while logged in, or an existing XSS foothold on the site. The fix scopes the selector to real .theme elements and applies $.escapeSelector() before injection.
- Chains CSRF with jQuery selector injection in wp-admin theme preview/install flow
- Second stage abuses Mobile Repair Zone 2.5.4 AJAX handler lacking nonce and capability checks
- RCE requires admin interaction via crafted link or an existing XSS foothold
- Fixed in 7.1.1 by scoping selectors and applying $.escapeSelector()
- Sites with DISALLOW_FILE_MODS enabled cannot reach the full RCE outcome
- Vendors
- WordPressPatchstack
- Organizations
- pwn.ai
From the original article
3 min read at patchstack.com
WordPress 7. 1. 1 patched a vulnerability reported by pwn.
By Chazz Wolcott · patchstack.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.