Click2Shell WordPress Flaw Lets Hackers Execute PHP Code and Take Over Websites

A recently disclosed WordPress vulnerability, known as Click2Shell, could let attackers execute remote PHP code on vulnerable sites after convincing a logged-in administrator to click a specially crafted link.

WordPress version 7.1.1, released on September 17, 2026, addresses this issue. Researchers at PWNAI reported that the flaw exploits WordPress’s theme-preview workflow to install a theme from the official WordPress.org directory silently.

When combined with another vulnerability in a susceptible theme, this forced installation can lead to a complete compromise of the website.

WordPress identified this bug as one of 11 security fixes in the 7.1.1 maintenance and security release. It describes a vulnerability where specially crafted URLs could automatically install and preview an inactive theme from WordPress.org. At the time of the research publication, a CVE identifier had not yet been assigned.

How Click2Shell Works

The core issue arises from inconsistent handling of the theme parameter used by the WordPress theme installer. When an administrator opens a standard theme-preview URL, WordPress queries the WordPress.org Themes API for the matching theme and displays a preview.

According to the researchers from PWN AI, while the server-side API canonicalizes the provided value into a valid theme slug, the browser-side JavaScript retains the original URL-supplied value when constructing a jQuery selector.

An attacker can inject selector syntax into that value. Although the API resolves the request to a legitimate catalog theme, the malformed client-side selector can interact with the genuine Install control on the theme card. WordPress JavaScript then programmatically triggers a click on that control.

As a result, an authenticated administrator can be tricked into installing an attacker-selected theme that is officially hosted on WordPress.org without manually clicking Install or Activate.

This process utilizes the administrator’s active session, permissions, and installation nonce through the WordPress interface itself.

The installed theme remains inactive, ensuring that the website’s visible appearance does not change. This stealthy behavior may make it harder for administrators to notice the activity.

The forced-install issue alone does not directly allow arbitrary theme uploads; it only installs a package available in the official WordPress.org theme catalog. However, PWNAI demonstrated that inactive themes can still present security vulnerabilities.

WordPress may load an inactive theme’s functions.php file when handling a Customizer preview. In the reported proof of concept, the researchers used version 2.5.4 of the Mobile Repair Zone theme, which allegedly exposed an AJAX-based plugin installation function that lacked adequate nonce validation or capability checks.

Once this PHP code was executed during a Customizer request, the vulnerable theme could fetch, unpack, and load a plugin package provided by the attacker. This turned the WordPress Core forced-install mechanism into server-side PHP execution with the permissions of the WordPress web server process.

A successful compromise could grant attackers access to WordPress configuration data, database credentials, the ability to create administrator accounts, modify site content, deploy malware, access WooCommerce or plugin data, and potentially take control of the underlying hosting environment.

Patch and Mitigation

WordPress 7.1.1 addresses the vulnerable selector construction by escaping the URL-derived slug before it is inserted into jQuery selector syntax. The update also limits matching to legitimate theme-card elements, preventing injected selector characters from navigating to the Install button.

Administrators should promptly update WordPress Core to version 7.1.1 or later. Site owners should also review installed themes, especially unused or inactive ones, and remove packages that are no longer needed.

Additional defensive measures include auditing WordPress administrator accounts, examining theme and plugin installation logs, reviewing recently modified files, and ensuring that themes and plugins enforce nonce checks and capability validation for all administrative AJAX actions.

This research highlights a broader security concern within WordPress: inactive themes are not necessarily harmless. If their PHP can be loaded through preview or customization workflows, vulnerable code in an unactivated theme may still offer attackers a path to compromise the site fully.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC