WordPress Click2Shell Flaw Enables Theme Installs, Chains to Code Execution
A critical vulnerability dubbed Click2Shell in WordPress core allows a crafted web link, when opened by a logged-in administrator, to install themes from WordPress.org without further user interaction.
WordPress has released patches to address a critical vulnerability, identified as Click2Shell, that could allow attackers to install themes from the official WordPress.org directory without explicit user consent. The flaw, reported by researchers at pwn.ai, requires a logged-in administrator to click a specially crafted web link. While the vulnerability on its own only facilitates the installation of legitimate themes, it can be chained with other vulnerabilities within a theme to achieve arbitrary code execution on the affected server.
The security fix was distributed on September 17, 2026, in WordPress version 7.1.1. This release is classified as a security update, and WordPress strongly advises immediate application of the patch. Currently, there is no evidence to suggest that this vulnerability has been actively exploited in the wild. The installed theme remains inactive, meaning the website's appearance is not altered, and no immediate visual indication of compromise would be apparent.
The Click2Shell vulnerability exploits a discrepancy in how different components of WordPress interpret a crafted URL. The WordPress.org directory correctly identifies the URL's parameter as a theme name and retrieves the corresponding theme. However, the administrator's browser, when processing the same URL, incorrectly parses certain characters within the link. These characters are then used to trigger the 'Install' button action within the WordPress administration interface, effectively automating the theme installation process.
Crucially, the attack leverages the administrator's existing logged-in session. This means the attacker does not need to provide separate authentication credentials or security tokens, as these are implicitly supplied by the active administrator session. This significantly lowers the barrier to exploitation for attackers targeting WordPress sites with administrative users.
While the initial forced installation of a theme is not inherently malicious, it serves as a critical first step in a more dangerous attack chain. WordPress's Customizer tool, for instance, can load a theme's PHP code even if the theme is not actively in use, creating an opportunity for exploitation. The pwn.ai team demonstrated this by using a theme, 'Mobile Repair Zone,' which contained a secondary vulnerability.
This secondary flaw in the 'Mobile Repair Zone' theme allowed it to fetch a web address from the request, download a payload, and execute its code without requiring any user permission or security token validation. When chained with the Click2Shell vulnerability, this allowed the attacker to achieve arbitrary code execution on the server, turning a simple theme installation into a full system compromise.
Researchers rated the standalone Click2Shell vulnerability with a CVSS score of 7.1 (High severity), while the complete attack chain leading to code execution was assessed as critical with a CVSS score of 9.6. WordPress has not yet published its own official severity rating for the core flaw, but its advisory notes that "Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org." A CVE identifier is expected to be assigned, according to pwn.ai.
The fix is included in WordPress 7.1.1 and backported to supported branches as far back as version 4.7. The release notes indicate that the vulnerability affects WordPress versions from 6.0 up to the latest releases prior to the patch. While no specific workaround was provided, updating the WordPress core is the definitive solution. The attack's reliance on a logged-in administrator clicking a malicious link also provides a layer of defense, emphasizing the importance of user awareness and security best practices.
The vulnerability, dubbed Click2Shell, was patched in WordPress 7.1.1 on September 17th. The new article provides further technical detail on the exploit chain, explaining how a crafted theme slug can be interpreted differently by WordPress.org's API and frontend JavaScript, leading to a Cross-Site Request Forgery (CSRF) that can be chained into selector injection. This allows an administrator to be tricked into installing and previewing a malicious theme, ultimately enabling the execution of an attacker-controlled plugin.