Click2Shell WordPress Flaw Lets Attackers Gain RCE With a Single Malicious Link
Researchers disclosed Click2Shell, a WordPress exploit chain that turns a single malicious link clicked by an admin into remote code execution; fixed in WordPress 7.1.1.
Researchers Paulos Yibelo and pwn.ai disclosed Click2Shell, chaining a WordPress Core theme-installer selector injection with an insecure AJAX handler in the Mobile Repair Zone 2.5.4 theme to achieve remote code execution. The Core flaw lets a crafted URL force-install an inactive WordPress.org theme with no attacker account, leveraging a logged-in administrator's session and nonce. WordPress fixed the selector injection in version 7.1.1 (September 17, 2026) via changeset 63664, in a release containing 11 security fixes. The standalone forced-install flaw is rated CVSS 3.1 7.1 while the full RCE chain is considered critical, and no in-the-wild exploitation or CVE identifier has been reported.
- Crafted URL forces installation of a WordPress.org theme using the admin's authenticated session, requiring no attacker account.
- Inactive Mobile Repair Zone 2.5.4 theme exposes an AJAX handler lacking nonce and capability checks, enabling attacker-supplied PHP execution.
- Impact includes wp-config.php credential theft, database and WooCommerce data access, file tampering, user creation, and possible hosting takeover.
- Patch restricts matching to genuine div.theme cards and applies jQuery escapeSelector() to URL-derived slugs.
- Disclosure began August 22, patch shipped September 17; no CVE assigned and no exploitation observed.
- Vendors
- WordPress
- Products
- WordPress CoreMobile Repair Zone
- Organizations
- pwn.aiWordPress.org
From the original article
3 min read at cybersecuritynews.com
WordPress administrators are being urged to update after researchers disclosed Click2Shell, an exploit chain that can turn one malicious link into remote code execution (RCE) on a vulnerable website. The issue begins with a WordPress Core theme-preview weakness that silently installs an attacker-selected theme from the official directory, then becomes a server compromise when chained […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.