WordPress has released a security update to fix a newly discovered vulnerability that researchers have named Click2Shell. The flaw can allow a specially crafted link to automatically install a theme from the official WordPress.org directory when opened by a logged-in administrator. The administrator does not need to manually click the Install button for the theme to be added to the website. Researchers from security firm pwn.ai reported the issue, and WordPress addressed it in version 7.1.1 released on September 17, 2026.
The vulnerability itself does not directly allow an attacker to upload any theme or execute arbitrary code on a WordPress server. Instead, it forces WordPress to install a legitimate theme selected by the attacker from the WordPress.org directory. The installed theme normally remains inactive, meaning the website’s visible design does not immediately change and the administrator may not notice anything unusual. However, researchers found that this behavior can become much more serious when combined with another security weakness inside the installed theme. This combination can eventually allow an attacker to execute their own code on the server.
The attack works because different parts of WordPress handle the same crafted link in different ways. The WordPress.org theme directory interprets part of the link as a normal theme name and returns a legitimate theme, while the administrator’s browser continues processing the additional characters included in the original URL. Those characters can cause WordPress’s own JavaScript code to locate and trigger the theme installation button automatically. Since the administrator is already logged in, their existing session provides the required permissions and security token for the installation. This means the attacker does not need to know the administrator’s password or directly obtain their security credentials.
The researchers also demonstrated how the forced theme installation could be connected to another vulnerability to achieve code execution. They used a theme called Mobile Repair Zone that contained a separate security issue involving a background handler. That handler could receive a web address, download a package from it and execute its contents without properly checking the user’s authorization or security token. WordPress’s Customizer can also load PHP code from an installed theme while generating a preview, even when that theme has not been activated. By combining these behaviors, researchers demonstrated a chain that could allow attacker-controlled code to run on the WordPress server.
According to the researchers, the Click2Shell core flaw has a CVSS score of 7.1, while the complete attack chain reaching code execution was rated 9.6. WordPress itself did not publish its own severity score for this issue and described the vulnerability as allowing specially crafted URLs to automatically install and preview an inactive theme from WordPress.org. At the time of the report, the vulnerability had not received a CVE identifier. Researchers also said there was no evidence that Click2Shell had been used in real-world attacks. The important point is that successful exploitation still requires a logged-in administrator to open the attacker’s specially crafted link.
WordPress has fixed Click2Shell in version 7.1.1, which is a security and maintenance release containing 11 security fixes along with other bug fixes. The security fixes are also being backported to supported WordPress branches, currently reaching back to version 4.7 where applicable. WordPress recommends updating websites immediately, and sites supporting automatic background updates may receive the update automatically. No separate workaround was provided by WordPress or pwn.ai, so updating the WordPress core is the main protection against the demonstrated Click2Shell attack. Website owners should also keep their themes and plugins updated and review unusual administrator activity after applying the security update.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
