WordPress has just patched a critical vulnerability that could have allowed attackers to take control of websites without needing a login. Dubbed “Click2Shell,” this flaw was discovered by pwn.ai and affects all versions of WordPress from 4.7 upwards.
The issue is with the way WordPress handles theme previews, which can be exploited using specially crafted URLs. When an administrator visits such a URL, they may unwittingly install a malicious theme on their site. What’s more alarming is that this theme doesn’t even need to be active for the vulnerability to work – an inactive theme can still be used by an attacker to execute code remotely.
This “Click2Shell” vulnerability has serious implications because it requires no special privileges or login credentials from the administrator. As pwn.ai explained, all an attacker needs is a single visit from a logged-in user on the target website. This makes it particularly worrying for sites that have multiple users with administrative access. In their advisory, WordPress warns that the issue can be exploited via URLs, even if the site’s main theme remains active.
The vulnerability was fixed in version 7.1.1 of WordPress and also patched in older iterations back to version 4.7. Pwn.ai received a $300 bug bounty reward for reporting the issue, which is their maximum amount. The company has published technical details and proof-of-concept code demonstrating how the flaw works.
What’s particularly disturbing about this vulnerability is that it affects over 40 third-party themes on WordPress, many of which are popular among users. These themes can be used to execute PHP code even when they’re not active, making them a potential threat to sites running these plugins. As pwn.ai points out, an administrator might not even notice the abnormal behavior occurring on their site.
For website administrators and owners, it’s essential to update your WordPress version to 7.1.1 or higher as soon as possible. This will patch the “Click2Shell” vulnerability and prevent potential attacks from exploiting this flaw. It’s also crucial to be cautious when using theme previews and only visit URLs that are trusted and verified.
While this issue has been patched, it serves as a reminder of the importance of regularly updating software and being vigilant about website security. By staying informed and taking proactive measures, you can help prevent similar vulnerabilities from compromising your site in the future.
Source: SecurityWeek — 2026-09-22