WordPress administrators are being urged to update their websites after security researchers disclosed Click2Shell, an exploit chain that can turn a malicious link into remote code execution on a vulnerable WordPress website.
The attack starts with a vulnerability in WordPress Core that can silently install an attacker-selected theme from the official WordPress.org directory. When combined with insecure code in that theme, the attack can eventually allow an attacker to execute their own PHP code on the server.
WordPress fixed the Core vulnerability in WordPress 7.1.1, released on September 17, 2026. The update includes 11 security fixes, 17 Core bug fixes, and 19 Block Editor fixes.
The official WordPress advisory credits security researcher Paulos Yibelo and pwn.ai for discovering the issue and recommends that administrators update immediately.
The attack does not require the attacker to have a WordPress account. However, it requires a logged-in administrator to visit a specially crafted malicious URL. The administrator’s authenticated session provides the permissions and security nonce needed to perform the theme installation. The attack abuses trusted WordPress JavaScript to make the administrator’s browser perform the action.
Researchers found that the theme installer processes the supplied theme value differently in two places. The WordPress.org Themes API converts the input into a valid theme slug, while the administrator’s browser keeps the original characters and uses them inside a jQuery selector.
By carefully crafting the selector, an attacker can escape the intended attribute match and reach the legitimate Install control for a theme. WordPress then installs the selected theme from the official WordPress.org directory.
This vulnerability by itself does not allow an attacker to upload an arbitrary theme or immediately execute code. The installed theme also remains inactive, so the website may continue to look completely normal.
The second stage is what turns the forced installation into a serious compromise.
Researchers demonstrated the complete attack using Mobile Repair Zone 2.5.4. During a Customizer preview, WordPress loaded PHP code from the inactive theme. The researchers found an AJAX handler that lacked both a nonce check and a capability check.
The handler accepted attacker-controlled plugin details and a package URL. This allowed an attacker to make the server download and unpack an archive and then load its PHP entry point.
That results in remote code execution under the web server’s account.
A successful attack could give an attacker access to wp-config.php and database credentials. They could potentially read WordPress or WooCommerce data, modify website files and content, create new users, steal secrets available to the PHP worker, and potentially use the compromised website to access the wider hosting environment.
In other words, the WordPress Core vulnerability acts as a forced-install mechanism, while vulnerable code in the installed theme provides the path to executing attacker-controlled PHP.
WordPress fixed the selector injection issue in changeset 63664. The patch restricts the matching process to a genuine div.theme card and uses jQuery’s escapeSelector() when processing the URL-derived theme slug. This prevents characters such as quotation marks, combinators, and comment syntax from being interpreted as executable CSS selector elements.
pwn.ai rated the standalone forced-install vulnerability High severity, with a CVSS 3.1 score of 7.1. The researchers considered the complete exploit chain leading to remote code execution to be Critical.
At the time of disclosure, WordPress had not published a final severity rating or CVE identifier. There was also no evidence of the vulnerability being exploited in the wild.
The disclosure process began on August 22, when researchers reported the selector injection and automatic theme installation behavior. They provided the complete pre-activation RCE chain on September 1. WordPress released the fix on September 17, and pwn.ai published its detailed technical analysis on September 18.
Website owners should update to WordPress 7.1.1 or apply the corresponding security update for their supported WordPress branch. WordPress said the fixes were also being backported to security-supported branches going back to version 4.7, although only the latest WordPress version is actively supported.
Administrators should also verify that automatic updates are working, review recently installed themes and plugins, and check for unexpected PHP files or newly created accounts.
It is also worth reviewing suspicious requests involving theme-install.php and Customizer-related admin-ajax.php endpoints, particularly on websites that may have been exposed to the attack.
If you need help securing, maintaining, or developing a WordPress website, Techlomedia also provides WordPress development and security services, including custom WordPress development, plugin and theme work, security checks, vulnerability fixes, and website hardening.
Related Posts
