New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution

Severity

High

Detail

WordPress has released security updates addressing a vulnerability in its core software that can allow a specially crafted link opened by a logged-in administrator to automatically install and preview a theme from the official WordPress.org directory without the administrator manually clicking the Install button. Security researchers at pwn.ai named the attack chain Click2Shell.

The vulnerability itself does not allow an attacker to upload an arbitrary theme. However, researchers demonstrated that it can be chained with a separate vulnerability in an installed theme to achieve code execution on the WordPress server. The core vulnerability was fixed in WordPress 7.1.1, released on September 17, 2026. There is currently no evidence that Click2Shell has been exploited in the wild.

How?

Click2Shell abuses inconsistent processing of specially crafted URLs by WordPress and its administrator-side JavaScript. WordPress.org interprets the supplied value as a legitimate theme name, while the administrator’s browser processes the original URL differently. By manipulating the URL with specially crafted characters, an attacker can cause the browser-side code to trigger the theme’s Install action automatically.

Because the victim is already authenticated as a WordPress administrator, the existing administrator session provides the permissions and security token required for the theme installation. The attacker therefore does not need to obtain the administrator’s credentials.

The installed theme remains inactive, so the website’s normal appearance does not immediately change. However, WordPress can load PHP code from an inactive theme when generating a Customizer preview.

Researchers demonstrated the attack by chaining Click2Shell with a separate vulnerability in the Mobile Repair Zone 2.5.4 theme. The vulnerable theme contained an AJAX handler that could retrieve a remote package and execute its code without properly verifying permissions or a security token. This allowed the researchers to progress from forced theme installation to PHP code execution on the WordPress server.

The researchers rated the standalone forced-install vulnerability as High severity with a CVSS score of 7.1, while the complete attack chain leading to code execution was rated Critical with a CVSS score of 9.6. No CVE identifier has been assigned to the vulnerability at this time.

WordPress fixed the vulnerability in version 7.1.1, with the security fixes backported to supported branches.

Recommendation

Organizations should implement a layered security approach to reduce the risk of Click2Shell exploitation:

• Upgrade WordPress to version 7.1.1 or the latest security release for the applicable branch.
• Restrict administrator privileges and avoid using administrator accounts for routine web browsing.
• Review installed WordPress themes and remove unnecessary or untrusted themes.
• Monitor WordPress logs for unexpected theme installations, Customizer activity, plugin installations, and suspicious AJAX requests.
• Monitor WordPress directories for unexpected PHP files or unauthorized modifications.
• Review themes and plugins for insecure AJAX handlers and ensure appropriate capability and nonce validation is implemented.

Source

https://thehackernews.com/2026/09/new-wordpress-click2shell-flaw-forces.html