A Critical Flaw in WordPress Core Allows Hackers to Execute Code on Servers
A recently discovered vulnerability in WordPress’s Core component has left thousands of websites vulnerable to hacking. The issue, known as Click2Shell, allows attackers to execute PHP code on a server without needing administrative credentials. This means that even if an attacker doesn’t have access to the website’s backend, they can still install malware or steal sensitive data.
The flaw was discovered by security researcher Paulos Yibelo and reported to WordPress on August 22. It affects all versions of WordPress prior to version 7.1.1, which was released last week to address the issue. The vulnerability is a pre-authenticated remote code execution chain that allows an attacker to install any theme in the official WordPress.org catalog and run arbitrary PHP files.
Here’s how it works: an attacker sends a crafted link to a logged-in administrator, who must visit the URL for the attack to be successful. Even if the administrator doesn’t click on the link, the website can still be compromised. Once the Customizer preview loads the inactive theme’s PHP code, it is executed on the server.
The researcher demonstrated the issue by using a vulnerable WordPress theme as the second component in the chain that executed the attacker’s PHP code. The full technical report provides a complete proof-of-concept exploit for achieving server-side remote code execution. This means that an attacker could leverage this access to create rogue admin accounts, inject malicious scripts, or steal sensitive data.
The good news is that WordPress has already fixed the vulnerability in version 7.1.1. However, administrators who cannot install the update immediately can take some precautions to mitigate the risk. For example, websites with ‘DISALLOW_FILE_MODS’ enabled cannot be forced to install the theme or a malicious plugin. Nevertheless, switching to the latest WordPress version is still highly recommended, especially given that complete technical details and a proof-of-concept exploit are already public.
This vulnerability highlights the importance of keeping software up-to-date and being cautious when clicking on links from unknown sources. Administrators should also be aware of their website’s configuration settings, such as ‘DISALLOW_FILE_MODS’, to minimize potential damage in case of an attack.
Source: Bleeping Computer — 2026-09-21