WordPress has patched a vulnerability dubbed Click2Shell that could allow an attacker to silently install a theme and execute PHP code on the targeted website.
The attack does not require the threat actor to have a WordPress account, but it does require a logged-in administrator to visit a specially crafted link.
The vulnerability was discovered by Paulos Yibelo at pwn.ai, who reported the issue to WordPress on August 22, 2026. WordPress fixed it in version 7.1.1, released on September 17 as part of a security update that addresses 11 vulnerabilities.
WordPress is the world's most widely used content management system, powering a significant portion of websites globally. Its administrators can install and preview themes directly from the official WordPress.org catalog through the site's administration panel.
Click2Shell exploits a discrepancy in how WordPress handles the name, or “slug,” of a theme passed through a theme-preview URL.
According to pwn.ai, the WordPress.org Themes API sanitizes this value before searching the theme catalog. However, JavaScript running inside the WordPress administration panel previously reused the original, unsanitized value inside a jQuery selector.
By inserting specially crafted characters into the URL, an attacker could manipulate that selector so WordPress' own JavaScript automatically clicked the legitimate Install button for an attacker-selected theme.
The action uses the administrator's existing permissions and security token, meaning the administrator does not have to manually approve the installation. The newly downloaded theme also remains inactive, so the site's appearance does not change.
To turn this behavior into remote code execution, the researchers chained it with a separate vulnerability in Mobile Repair Zone 2.5.4, a theme available through the official WordPress.org catalog.
Although inactive themes normally do little, WordPress can temporarily load their PHP code when they are opened through the Customizer. Mobile Repair Zone contained an AJAX handler that could download and install a plugin from a supplied URL without performing the expected nonce or capability checks.
The researchers demonstrated that Click2Shell could first install the vulnerable theme, load it through the Customizer, and then abuse its installer to execute attacker-supplied PHP on the server.
Patchstack notes that the attack is not a fully automatic drive-by compromise. A logged-in administrator must load the malicious URL, such as through targeted phishing, or an attacker would need another vulnerability such as stored XSS to trigger the request from within the site. Installations configured with DISALLOW_FILE_MODS would also prevent the theme-installation stage.
WordPress addressed the core issue by escaping the theme slug before inserting it into the jQuery selector and restricting the selector to legitimate theme elements. This prevents crafted characters from being interpreted as selector syntax.
WordPress has also released security updates for supported older branches, including 7.0.5, 6.9.8, and 6.8.9, with fixes backported to numerous earlier releases.
No CVE identifier had been published when pwn.ai disclosed the technical details.
WordPress administrators should install the latest security release available for their branch as soon as possible. Sites that do not need administrators to install themes or plugins can further reduce exposure by disabling file modifications through WordPress configuration.
Leave a Reply