- WordPress patched the “Click2Shell” vulnerability in version 7.1.1, released September 17, 2026.
- The flaw lets a crafted link, opened by a logged-in administrator, automatically install a theme from the official directory without a click.
- Security firm pwn.ai demonstrated that chaining this bug with a separate theme weakness achieves remote code execution, rated critical at 9.6 CVSS.
- No real-world exploitation of Click2Shell has been reported, unlike a separate July flaw (wp2shell) that CISA listed as actively exploited.
- WordPress advises immediate updating; no workaround is available for sites that cannot update.
WordPress released an emergency security patch on September 17 to fix a critical vulnerability chain dubbed “Click2Shell,” reported by researchers at pwn.ai. The core flaw, rated high severity at 7.1 CVSS, allows a specially crafted link to install a theme from WordPress.org when a logged-in administrator simply opens the link — no click on an Install button is required.
Researchers explained that the attack works because two parts of WordPress interpret the same link differently, as detailed on their blog. The installed theme remains inactive, so the site’s appearance does not change, but pwn.ai showed the chain can reach code execution by combining the forced install with a second vulnerability in the chosen theme itself.
According to the official release notes, the fix is included in WordPress 7.1.1 and all supported branches back to version 4.7. The researchers rated the full chain to code execution as critical, with a CVSS score of 9.6, though pwn.ai noted that “The Core bug does not accept an arbitrary theme ZIP by itself.”
WordPress described the issue as “Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.” No CVE identifier has been assigned yet, but the firm expects one. Site owners should update immediately, as no separate workaround is available. The vulnerability affects versions 6.0 through the releases just before the fix, confirmed in the version notes.
This is the second core flaw reported by pwn.ai in recent weeks; a similar issue in the login screen was also chained to code execution and patched in August. The unrelated “wp2shell” flaw, disclosed in July, requires no user interaction and has already been exploited in real attacks, according to CISA.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
