Click2Shell WordPress Flaw Lets Attackers Gain RCE With a Single Malicious Link

WordPress administrators are being urged to update after researchers disclosed Click2Shell, an exploit chain that can turn one malicious link into remote code execution (RCE) on a vulnerable website.

The issue begins with a WordPress Core theme-preview weakness that silently installs an attacker-selected theme from the official directory, then becomes a server compromise when chained with insecure pre-activation code in a theme.

WordPress addressed the Core flaw in version 7.1.1, released September 17, 2026, as part of an update containing 11 security fixes, 17 Core bug fixes, and 19 Block Editor fixes.

The official advisory describes the issue as specially crafted URLs automatically installing and previewing an inactive WordPress.org theme, credits Paulos Yibelo and pwn.ai, and recommends immediate updates.

The attack does not require the adversary to hold a WordPress account. It does, however, require a logged-in administrator to visit the malicious URL.

Click2Shell WordPress Vulnerability

The administrator’s authenticated session provides the installation capability and nonce, allowing trusted WordPress JavaScript to perform the sensitive action on the attacker’s behalf.

The vulnerability originates in the theme installer route, where a theme value is processed in two inconsistent ways. WordPress.org’s Themes API canonicalizes the supplied input into a valid catalog slug, while the administrator’s browser retains the original punctuation and inserts it into a jQuery selector.

Crafted selector characters can escape the intended attribute match, traverse the returned theme card, and reach the genuine Install control, which WordPress then activates programmatically.

This behavior alone does not permit an arbitrary theme archive or immediate RCE. It installs a current package selected from the trusted WordPress.org catalog, and the theme remains inactive, leaving the site’s appearance unchanged. That lack of visible disruption makes the activity easy to miss and explains why the second stage is crucial.

Researchers demonstrated the complete chain with Mobile Repair Zone 2.5.4. During a Customizer preview, WordPress loaded the inactive theme’s PHP, exposing an authenticated AJAX handler that lacked both a nonce check and a capability check.

The handler accepted attacker-controlled plugin details and a package URL, downloaded and unpacked the supplied archive, and loaded its PHP entry point, producing code execution under the web server’s account.

A successful compromise could allow attackers to access wp-config.php and database credentials, read WordPress or WooCommerce data, alter files and content, create users, steal secrets available to the PHP worker, and potentially seize the wider hosting environment.

The Core weakness therefore acts as a forced-install primitive, while the vulnerable theme supplies the bridge from an inactive package to executable attacker-controlled PHP.

WordPress fixed the selector injection in changeset 63664. The patch restricts matching to a genuine div.theme card and applies jQuery’s escapeSelector() to the URL-derived slug before constructing the selector. As a result, injected quotation marks, combinators and comment syntax are interpreted as literal slug characters instead of executable CSS selector structure.core.trac.

Pwn.ai assessed the standalone forced-install issue as High severity with a CVSS 3.1 score of 7.1 and considered the demonstrated RCE chain Critical. WordPress had not published a final severity or CVE identifier at disclosure, and public reporting indicated no evidence of exploitation in the wild.

The disclosure process began on August 22, when researchers reported the selector injection and automatic installation behavior. They delivered the full pre-activation chain on September 1, WordPress shipped its correction on September 17, and pwn.ai published the detailed technical analysis the following day.

Site owners should install WordPress 7.1.1 immediately or apply the corresponding security release for their supported branch. WordPress said fixes were being backported where necessary to security-supported branches through 4.7, although only the latest version is actively supported.

Administrators should also verify automatic updates, review recently installed themes and plugins, inspect unexpected PHP files and account changes, and investigate suspicious requests to theme-install.php or Customizer-enabled admin-ajax.php endpoints.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC