Critical WordPress Click2Shell Flaw Lets Attackers Gain RCE

Key Takeaways

• A critical vulnerability, dubbed Click2Shell, allows remote code execution (RCE) on WordPress websites through a chained exploit.
• The attack leverages a core WordPress theme-preview flaw combined with insecure pre-activation code in certain themes.
• WordPress Core version 7.1.1, released on September 17, 2026, addresses the initial flaw.
• The exploit requires a logged-in administrator to click a malicious link but does not require an existing WordPress account for the attacker.
• Site administrators must update to WordPress 7.1.1 immediately and review their installed themes and plugins for potential compromise.

WordPress Click2Shell Flaw Unlocks Remote Code Execution

A severe exploit chain, branded Click2Shell, has been revealed, posing a significant threat to WordPress sites. This vulnerability enables attackers to achieve remote code execution (RCE) on a target website simply by enticing a logged-in administrator to click a specially crafted malicious link.

The attack vector initiates with a weakness within the WordPress Core theme-preview functionality. This flaw allows for the silent installation of an attacker-chosen theme from the official WordPress directory. The exploit then escalates to a full server compromise when this initial action is combined with insecure pre-activation code present in certain themes.

WordPress has already rolled out a fix for the Core vulnerability in version 7.1.1, which was released on September 17, 2026. This comprehensive update included 11 security fixes, 17 Core bug fixes, and 19 Block Editor improvements. The official advisory from WordPress described the issue as “specially crafted URLs automatically installing and previewing an inactive WordPress.org theme,” crediting Paulos Yibelo and pwn.ai for its discovery. The advisory strongly recommends immediate updates.

Crucially, the attack does not necessitate the attacker possessing an existing WordPress account. However, it does rely on a logged-in administrator visiting the malicious URL, leveraging their authenticated session to facilitate the theme installation and bypass nonce checks.

Deep Dive into the Click2Shell Vulnerability

The core of the vulnerability lies within the theme installer route, where a theme’s value is processed inconsistently. The WordPress.org Themes API normalizes the input into a valid catalog slug, but the administrator’s browser retains the original punctuation, inserting it into a jQuery selector. This discrepancy allows for selector injection.

Maliciously crafted characters within the selector can escape the intended attribute match, navigate through the returned theme card, and ultimately activate the genuine “Install” control, which WordPress then programmatically triggers. While this behavior alone does not permit the installation of arbitrary theme archives or immediate RCE, it does install a legitimate package from the trusted WordPress.org catalog. The theme remains inactive, and the site’s appearance is unchanged, making the initial compromise subtle and difficult to detect without the second stage of the attack.

Researchers demonstrated the complete RCE chain using Mobile Repair Zone version 2.5.4. During a Customizer preview, WordPress loaded the newly installed but inactive theme’s PHP code. This exposed an authenticated AJAX handler within the theme that critically lacked both a nonce check and a capability check. This handler accepted attacker-controlled plugin details and a package URL, subsequently downloading and unpacking the supplied archive, then loading its PHP entry point. This sequence resulted in code execution under the web server’s account.

A successful compromise could grant attackers extensive control, including access to wp-config.php and database credentials, the ability to read WordPress or WooCommerce data, modify files and content, create new user accounts, steal secrets available to the PHP worker, and potentially gain control over the broader hosting environment. Thus, the Core weakness serves as a forced-install primitive, while the vulnerable theme provides the crucial bridge from an inactive package to executable, attacker-controlled PHP.

Patch Details and Severity

WordPress addressed the selector injection vulnerability in changeset 63664. The patch restricts matching to a genuine div.theme card and applies jQuery’s escapeSelector() function to the URL-derived slug before constructing the selector. This ensures that injected quotation marks, combinators, and comment syntax are interpreted as literal slug characters rather than executable CSS selector structures.

Pwn.ai assessed the standalone forced-install issue as High severity, assigning it a CVSS 3.1 score of 7.1. The full RCE chain demonstrated was deemed Critical. At the time of disclosure, WordPress had not published a final severity rating or a CVE identifier. Public reporting indicates no evidence of this vulnerability being exploited in the wild.

The disclosure process commenced on August 22, when researchers initially reported the selector injection and automatic installation behavior. The full pre-activation chain was delivered on September 1, leading to WordPress shipping its correction on September 17. Pwn.ai then published their detailed technical analysis the following day.

What You Should Do

• Update Immediately: Site owners must install WordPress 7.1.1 without delay. If running an older, supported branch, apply the corresponding security release. WordPress has stated that fixes are being backported to security-supported branches through 4.7, though only the latest version receives active support.
• Verify Automatic Updates: Ensure that your WordPress installation’s automatic update feature is functioning correctly.
• Review Themes and Plugins: Conduct an audit of recently installed themes and plugins for any unauthorized additions or suspicious activity.
• Inspect Files and Accounts: Look for unexpected PHP files, unauthorized account changes, or any unusual modifications within your WordPress directories.
• Monitor Suspicious Requests: Investigate any suspicious requests targeting theme-install.php or Customizer-enabled admin-ajax.php endpoints in your server logs.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.