Click2Shell WordPress Flaw Lets Hackers Execute PHP Code and Take Over Websites
WordPress 7.1.1 patches Click2Shell, which can force theme installs and enable PHP code execution.
Researchers at PWN AI disclosed Click2Shell, a WordPress theme-preview flaw fixed in version 7.1.1 on September 17, 2026. A crafted URL can cause a logged-in administrator to silently install a theme from the official WordPress.org catalog because browser-side jQuery retains the unsanitized theme parameter. Chained with Mobile Repair Zone 2.5.4, which exposed an AJAX plugin installer lacking nonce and capability checks, the issue can lead to PHP execution as the web server. No CVE had been assigned at publication, and the report does not describe confirmed in-the-wild exploitation.
- WordPress 7.1.1, released September 17, 2026, fixes Click2Shell.
- A crafted preview URL can silently install an official WordPress.org theme.
- The PoC chained Mobile Repair Zone 2.5.4 into server-side PHP execution.
- No CVE was assigned, and in-the-wild exploitation was not reported.
- Vendors
- WordPress
- Products
- WordPressMobile Repair Zone
From the original article
3 min read at gbhackers.com
A recently disclosed WordPress vulnerability, known as Click2Shell, could let attackers execute remote PHP code on vulnerable sites after convincing a logged-in administrator to click a specially crafted link. WordPress version 7. 1.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.