A newly discovered vulnerability in WordPress, known as Click2Shell, has been identified as a pre-authenticated remote code execution chain that allows attackers to install malicious themes and execute arbitrary PHP code on affected servers. This security issue, discovered by security researcher Paulos Yibelo of pwn.ai, was addressed last week with the release of WordPress version 7.1.1.
The Click2Shell flaw is a cross-site request forgery (CSRF) vulnerability that affects the Core component of WordPress. It works by exploiting a weakness in how WordPress handles theme preview URLs. When an administrator visits a crafted URL, it can lead to the installation of a malicious theme without their explicit consent. What’s more concerning is that even if the attacker doesn’t need to authenticate, a logged-in administrator must visit the link for the exploit to work.
The vulnerability relies on two components: the WordPress Themes API and JavaScript in the Administrator’s browser. The researcher found that when a value from a theme-preview URL is interpreted by the Themes API, it can be exploited further by buggy methods in JavaScript. This enables an attacker to add a vulnerable theme to a target website without explicit installation.
A successful attack could start with a crafted link that leads to installing a vulnerable theme in the catalog. Once the Customizer preview loads the inactive theme’s PHP code, it is executed on the server. To demonstrate this issue, pwn.ai used a vulnerable WordPress theme as the second component in the chain, showcasing how the vulnerability can be exploited to execute attacker-controlled PHP code.
The implications of Click2Shell are significant. An attacker could leverage access to user data, modify files, and even delete sensitive information like database credentials and authentication secrets stored in the ‘wp-config.php’ file. This access could also enable rogue admin account creation or injection of malicious scripts.
While an attacker does not need a WordPress account, installation nonce, or administrative privileges to exploit Click2Shell, it requires a logged-in administrator to visit the crafted link. Patchstack’s analysis highlights that only administrators have the necessary permission to install themes, while Author and Editor accounts lack this capability.
WordPress has since addressed the issue in version 7.1.1 by escaping the theme slug before using it in the jQuery selector and restricting the selector to actual theme cards. For those who cannot update immediately, websites with ‘DISALLOW_FILE_MODS’ enabled are protected from forced theme installations or plugin deployments.
Given the public availability of technical details and a proof-of-concept exploit, we strongly advise WordPress administrators to prioritize updating their platforms to version 7.1.1 as soon as possible.
Source: Bleeping Computer — 2026-09-21